A pretty old read, but one that I think of often: https://spectrum.ieee.org/telecom/se...es-of-cyberwar
Some more recent ponderings: https://spectrum.ieee.org/podcast/te...s-cyberwar-war
That being said, I find it totally believable that this is not the act of a state, but merely folks out to make a buck. Ransomware attacks have been rising globally, it was only a matter of time before someone ends up potentially hitting too big a target.