How is this "much more likely to be a malicious state actor"? There is literally nothing about this attack that indicates a state actor.
It’s likely to be a “state actor” for the same reason people like to use the term “state actor”: it’s so much more exciting than the alternative.
ransomware is not a typical attack from a state actor
How do you know it's not ths Chinese or North Koreans looking for bitcoins? It is documented they do transact in bitcoin on the hacking market a lot.
NotPetya had ties to Russian intelligence, and WannaCry had ties to North Korea. Not saying this is a state actor, just pointing out ransomware is just another tool for them.