3299
Disheartened by Wosar 's success , the group behind Kovter switched to several ransomware variants in the following months , and eventually settled on renting and distributing Locky starting with October , as part of an affiliate scheme , splitting the ransom payments with the Locky crew .
 ( ransom: the ransom payments,  the Locky crew: attacker, October: time, Locky: tool) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( ransom: the ransom payments,  the Locky crew: attacker, October: time, Locky: tool) 