From what I’ve seen these are mostly very unsophisticated. They basically grab a previously exploited user/password combo and then email that person with the extortion message. It’s usually just a bitcoin address too, you can’t even email them back for some fun ;P