The bot gains access to the databases, deletes all tables and databases, and leaves a ransom note demanding payment for data recovery. However, the bot only saves a small portion of the data, even if the ransom is paid.
The data wiping malware overwrites files, deletes system snapshots, and disables recovery options, making data recovery difficult and rendering affected systems unusable.