A new version of file-encrypting malware hides its sever inside an anonymous TOR network, making it safer for criminals to extort money from victims.