What initiates a ransomware attack

Let's pretend your site has been infiltrated and suddenly everything starts getting encrypted. What is the normal mechanism that kicks off this attack, is it kicked off by the ransomware group once they infiltrate, is there a count down timer, is it waiting for a specific time/day? What actually puts the attack in motion?

I'm sure there are lots of answers, I'm just trying to expand my understanding.