text: The disparity between technical competency in the infection vector vs the payment infrastructure makes "not criminals" a viable hypothesis. It appears that the mechanism for paying to get decrypt keys was shut down almost immediately, and was not thought through very well by the authors. The people analyzing the malware say it appears to be otherwise very competently written, and includes a custom tool for password extraction. Combine that with it being specifically targeted at Ukrainian government agencies and infrastructure (an accounting package mandated by the Ukrainian government called MeDoc is specifically exploited, going after its update mechanism).
  
  So, yeah, still early, but the hypothesis that this is just pretending to be ransomware is one to watch.