> What is the end-goal of this... would it be data exfiltration vs ransomware.

The end-goal is to gain complete access to the system - the outcome (data theft or ransomware) is customers choice