Ransomware attacks in US cities are using a stolen NSA tool