IIRC the Russian NotPetya attack on Ukraine was disguised as ransomware requesting Bitcoin, so there is some precedent for a state sponsored attack pretending

IIRC the Russian NotPetya attack on Ukraine was disguised as ransomware requesting Bitcoin, so there is some precedent for a state sponsored attack pretending to be criminals trying to make money.