Initial access brokers

Some criminals specialise in getting in and then sell that access to somebody else.

Which means the gap between your compromise and your ransomware event may be weeks, and the two may involve entirely different people. It is also why an apparently minor intrusion matters: a foothold nobody used is an asset somebody is trying to sell, and the buyer will have different intentions.