Ransomware linked groups appear to have joined the AnyConnect train in anger at the beginning of February.