The correct answer is:
The software connects to a command and control server to receive instructions or updates.
In many cases of crypto-malware (or ransomware), the infected system typically communicates with a central command and control (C&C) server that the attacker controls. This C&C server can send updates or further instructions to the malware, including encryption keys or additional payloads.