The guys developing the ransomware are not necessarily the guys behind this group. Even if the developers were in-house, they may not be managing the money. So

The guys developing the ransomware are not necessarily the guys behind this group. Even if the developers were in-house, they may not be managing the money. So hack may be not be as difficult as we might think. It is kind of ironic actually, the ransomware targeted billing systems of colonial, however they didn't really secure their own money.