The compromised machines call home to domains registered to the defendants in their own names. This is either state level incompetence or script kiddies gone wild.
it takes two minutes to read enough the article to know, it was contractors to State-level intelligence, doing side business as ordinary ransomware. As others say, this hardly seems to be a story at all, very common.. on all sides.