How REvil evolved into a ransomware collective