1626
From this point on , Cerber took over , encrypted files , and displayed its standard ransom note , leaving victims no choice but pay the ransom demand or recover data from backups .
 ( ransom: pay the ransom demand,  displayed its standard ransom note: attack pattern, encrypted files: attack pattern, took over: attack pattern, victims: victim, Cerber: tool) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( ransom: pay the ransom demand,  displayed its standard ransom note: attack pattern, encrypted files: attack pattern, took over: attack pattern, victims: victim, Cerber: tool) 