Reinvented ransomware shifts from pwning PC to wrecking websites
Found on The Register on Monday, 29 February 2016
The website variant of CTB Locker is encrypting all files on WordPress-powered sites and replacing the index.php with a file that displays instructions for paying the ransom.
Victims can decrypt two separately-encrypted files for free in a bid by attackers to demonstrate the legitimacy of the ransom demand.
That is why you do backups. Restore, update and move on.