cactus, play and bianlian are hitting a lot of organisations at the minute, but it's low-hanging fruit - construction companies, law offices, mom-and-pop-type operations
Not that they don't get hit as often, but you don't tend to hear about the big scores so much these days...
BTW ransomlook.io is a great resource for keeping track of what's going on, including links to tor leak sites for each group