You only attack people who will pay.
Yiu don’t attack people with no cash or who mighy respond in a negative way.
These guys will learn from their Russian counterparts. Attack big US companies and non-profits - they have cyber insurance that pays out handsomely when it comes to ransoms. Was amazed when I talked to a counterpart on that side of the field and how “low tech” some of the guys handling this stuff really are. Not that they are all tech neophytes - but some really are.