Computer security is hard. That's why ransomware attacks exist. It's just as hard for ransomware attackers as for their victims. If they were good at computer security, they'd be working a legitimate job. I find your incredulity strange, it's like hearing about the Valentine's day massacre and being shocked that mobsters could be at the receiving end of a Thompson for once.