I don't believe these people are 'cracking the encryption'.

Any virus writer is going to know how to use public-private crypto to encrypt the files in a non-reversible way. Only an amateur would use a basic XOR key or reverseable encryption with the key embedded in the binary.

Another commenter suggested the C&C server gets broken into. I doubt that too, since the criminals private key can sit entirely offline - all they have to do is periodically check for cryptocurrency payments and then publish the keys for the users who have paid to somewhere like pastebin, IPFS, etc. No real way to track the computer doing that, let alone break into it.