In all the years we have been fighting ransomware, we have never once found out the identity of the perpetrator. But there are some commonalities: it is usually foreign nationals who are operating as a business. The FBI has published information about countries where these individuals are often active, but we probably will never be able to answer this question.