Cybercriminals are using the noise of ransomware to their advantage as it provides the perfect cover to distract attention so they can take aim at their real target: exfiltrating IP, research, and other valuable data from the corporate network. The exfiltration of critical data is a key motivator that can be used to extort victims into paying even larger fees to recover assets. Security teams will naturally focus all their efforts on containment and remediation to minimize disruption. But once the infection has been taken care of and forensics are performed to investigate how the attack started, there can be signs that the infiltrators have been on the network for some time.
Source: https://www.helpnetsecurity.com/2021/01/21/ransomware-cover/