Cybercriminal gangs use these malicious programs in targeted attacks on large organizations in order to steal money. In late 2016, we detected an increase in the number of attacks, the main goal of which was to launch an encryptor on an organizations network nodes and servers. This is due to the fact that organizing such attacks is simple, while their profitability is high: The cost of developing a ransom program is significantly lower compared to other types of malicious software. The model of attack looks like this: Search for an organization with an unprotected server with RDP access.”]
Source: https://securelist.com/ransomware-in-targeted-attacks/77877/