Given the size and scale of the attack, is it not most likely that it's come from a state sponsored group? Even if it was individuals or a small group, the likelihood of them ever being prosecuted for this is slim to non-existent.
It does seem a bit too indiscriminate to be a state attack? And why would they be collecting ransom rather than using the backdoor to gather data quietly?
Apparently there is a new variant on the loose which doesn't have the kill switch.
Given the size and scale of the attack, is it not most likely that it's come from a state sponsored group? Even if it was individuals or a small group, the likelihood of them ever being prosecuted for this is slim to non-existent.