By contrast, ransomware is usually spread as widely as possible by criminals who demand modest sums for the safe return of data, typically around $500, because they want to collect from individuals as well as companies.

Why hackers who usually work for a superpower might start using a small-time criminal tactic is unclear. One reason is that deploying ransomware might be an easy way to extract some extra money once a conventional espionage job is over.

A more intriguing possibility is that these might be lean times for China’s industrial espionage hackers. Late last year President Obama and his Chinese counterpart Xi Jinping agreed not to support theft of intellectual property, and to assist each other in investigating cases that did occur. The deal was seen as a breakthrough after years of U.S. complaints about computer incursions from China.

The Cryptolocker ransomware message is not a welcome sight.

That agreement may have caused China to cut back on its sponsorship of hackers, driving them to find alternative forms of income, the security companies reporting the new malware campaigns told Reuters. If that theory is correct, companies might expect to see less of their data headed to China, but more of it locked up by malware with a ransom note attached.

Either way, we can expect ransomware to become more common. The FBI’s Internet Crime Complaint Center said on March 10 that it was notified of 2,453 ransomware infections by victims in 2015, who collectively paid $24.1 million to get their data back. The true figure for the U.S. is likely to be much higher, and the FBI expects the problem to grow.

(Read more: Reuters, Wall Street Journal, “Holding Data Hostage: The Perfect Internet Crime?” “Waiting for a Drop in Corporate Hacks After U.S.-China Deal,” “Hospital Forced Back to Pre-Computer Era Shows the Power of Ransomware”)