How cybercriminals use sales best practices in ransomware attacks