The groups behind most current ransomware campaigns are going for «fast cash,» by using spam campaigns and exploit kits such as Angler, and targeting wealthy countries in which people can afford to pay the ransom. (slaw.ca)
You can also rent time and capacity on your botnet for all the services it can provide: hosting cracked software for download, hosting fake sites for phishing messages (where people can input their passwords, in response to an email, under the impression that it belongs to Facebook or their bank), delivering DDoS attacks, and running spam campaigns. (scientificamerican.com)