606
However , one of the Tor gateways being used is altering bitcoin wallet addresses in the proxy , and redirecting the payment into other accounts , rather than those of the ransomware attacker .
 ransomware attacker: attacker; the Tor gateways being used is altering bitcoin wallet addresses: attack pattern
Given event type and trigger, please tell me the arguments of all the listed option. Output format is "name1: role1; name2: role2". 
Event type: ransom 
  Option: victim, attacker, payment method, attack pattern, damage amount, tool, time, price, place 
Text: {0} 
Answer:
 ransomware attacker: attacker; the Tor gateways being used is altering bitcoin wallet addresses: attack pattern