I've seen a lot of recent articles on the subject that claim it's moving in the targeted direction, here's an example:

Over the past few years, threat actors have shifted to much more targeted attacks that net higher Bitcoin payment returns for their efforts.

https://blog.cloudflare.com/targeted-ransomware-attack/

Edit: Commonly mentioned in the same breath:

- the move from just demanding a ransom for the key, to threatening publication of sensitive info

- trawling through the data to look for anything especially sensitive, as well as clues to what number to ask for in financial records