These groups aren't really "targeting" anyone. These ransomware attacks are as sophisticated as nigerian prince emails. Send out a lot of spam, wait for someone who clicks on it and is running outdated software and boom. Sooner or later you will encrypt something important enough to pay for.

I've seen a lot of recent articles on the subject that claim it's moving in the targeted direction, here's an example:

Over the past few years, threat actors have shifted to much more targeted attacks that net higher Bitcoin payment returns for their efforts.

https://blog.cloudflare.com/targeted-ransomware-attack/

Edit: Commonly mentioned in the same breath:

- the move from just demanding a ransom for the key, to threatening publication of sensitive info

- trawling through the data to look for anything especially sensitive, as well as clues to what number to ask for in financial records

> Send out a lot of spam, wait for someone who clicks on it and is running outdated software and boom.

outdated Windows software

And not by targeting hospitals?