When I was a mainframe programmer at IBM, one of they first things they taught us was how to stop the processor of a System/370 machine. If you can do that, ladies and gentlemen, you can bring down Bank of America, the US Army, the Social Security Administration, etc. So everyone there knew how to be a "black hat" hacker if we wanted to.
Was there money to be made in that? Surely. More money than IBM ever paid anyone! But the reason neither I nor any of my colleagues would ever dream of using our skills to hurt people is that last part of the sentence: it hurts people.
Yes, IBM did some awful stuff from helping Nazis to keeping apartheid alive in South Africa (over employee objections while I was there), but overall, the "corporation" provided valuable goods and services to real people who had to slog on in real jobs every day to get the world's real work done.
Oil companies are in the same boat. The world runs on oil and some ransomware attacks aren't going to change that. The idea that terrorism (and black hat hacking is absolutely a form of terrorism) is a useful way to change corporate behavior is so ill-informed that it's pathetic.
When asked about taking a "white hat" approach and selling legal pen testing (or even PTaaS), these developers declined saying they probably couldn't monetize their skills at the same level that way.
Well, I say, too effin' bad. If everyone optimizes solely for himself, there will be no one left. It's appalling to me that criminal organizations now recruit, have price lists, and get PR placement. These people and their products (and their communication channels) need to be turned off ASAP for everyone else's sanity and self-preservation.