A ransomware listing tied to a construction domain shows how extortion crews use public naming and pressure tactics even when a compromise has not been independently verified.