Could be independent hackers could be rogue US alphabet operatives with access, could be foreign state sponsored hackers . In today's world we have no clue. We just react to what happens and what we're told.
Most likely just cyber criminals looking to make a quick buck
It is ransomware after all
