My guess spreading + password resets + searching for files that can be downloaded/later used for crypto blackmail?
I think we are going to see some of the worst large scale ransom attempts shortly. They also timed it perfectly afternoon on hump day when everyone in USA is just getting ready for / back from lunch.
