Tag ransomware operations