A public victim post may look like a simple announcement, but in ransomware operations it is often the pressure point that turns a suspected intrusion into a negotiation.