Industry researchers suspect a Russian-linked criminal organization called DarkSide is behind the attack, though it has not publicly claimed responsibility.