THe nice property of terrorist attacks is that the terrorist groups need somebody in the country where the attack actually happens. You might be too late to catch them, they might commit suicide etc, but in general, that property makes law enforcement work a whole lot easier. With ransomware, even if you can say with 100% certainty that Dmitrij Smith from St. Petersburg did it, this still doesn't get you any closer to putting said Dmitrij smith behind bars in the US. It's highly likely that you can't even interrogate / surveil the suspect, making it that much harder to see if they were acting on their own and out of pure greed or on government orders. And that's if you know who did it, cyber attack attribution is complex, and you often can't say anything with certainty.