stand up an old version of wordpress with poor admin/admin credentials on an external box, and wait a couple hours. You'll find all sorts of malware on a linux box. ransomware included. Pretty common, though it seems most people who compromise linux machines use them to launch further attacks, not ransomware. The ransomware linux variants I see all do about the same thing: wipe various /var/log/* logfiles, they encrypt all your mysql dbs, your homedir files, and your webserver docroot.