I just saw this while doing a deep Google search (i.e. beyhond page 10):
Dridex botnet distributor now serves Avira (February 5, 2016)
This is just brilliant, hacking back the criminals' servers so they don't serve their crap. One step further would be to email back ransomware victims a note listing their unlock codes.