[mcintyre1994]

IIRC the Russian NotPetya attack on Ukraine was disguised as ransomware requesting Bitcoin, so there is some precedent for a state sponsored attack pretending to be criminals trying to make money.