They fucked up by targeting infrastructure. If they stuck with small companies they could keep doing it till the cows came home. But now they have governments against them so now they will be hunted down.
Over the past few years, threat actors have shifted to much more targeted attacks that net higher Bitcoin payment returns for their efforts.
https://blog.cloudflare.com/targeted-ransomware-attack/
Edit: Commonly mentioned in the same breath:
- the move from just demanding a ransom for the key, to threatening publication of sensitive info
- trawling through the data to look for anything especially sensitive, as well as clues to what number to ask for in financial records
outdated Windows software