Ransomware-as-a-service

Ransomware operates as a service business: one group builds the tooling, another breaks in and uses it, and they split the proceeds.

That division of labour is why the volume is so high. Breaking in no longer requires the ability to write malware, and writing malware no longer requires the ability to break in. It also means attribution is harder, because the same tooling appears behind wildly different intrusions.