drop usb sticks with shortcuts, and a $RECYCLE.BIN folder that has python312.dll wich is the dropper and legimate pythonw.exe/ short cut opens pythonw.exe profit.
Depends heavily on who your preferred victims are. Targeting individual users is easy. Spread malware through social media, masquerading it as legit tools. However, if you target individuals, you are going to have an extremely, and I mean EXTREMELY, low chance of getting users to pay up. Most individuals do not care enough to spend money to recover their files - take it from me, I have had some experience with small-scale ransomware.
On the flip side, if you care about actual profit, you're going to want to go for larger firms (Big Game Hunting, as it's otherwise known). This is where the big money lies. However, you're going to want the following at a minimum:
Extremely good OpSec - even if you claim you're in a country that doesn't punish for cybercrime, at best you're going to have your face and full identity doxed by the feds, and you'll never be able to travel to any other country without very well made fake documentation.
A stable, reliable, efficient locker - various ransomware groups have found this out the hard way, you don't want to end up wasting access on a locker that gets fucked in the ass or fails.
A significant amount of both red-team and blue-team experience - even if you buy access from an IAB, they'll rarely do all the work for you. You're still going to have to perform lateral movement, gain more access to the system, remain hidden from blue teams, etc.
A whole lot more of other stuff that it would take too long to mention.
Honestly, if you're asking these kinds of questions, stay far away from targeting companies, and stick to small-scale campaigns focused on individual users.