A state actor will use more precise techniques to attack specific targets. Think SolarWinds and Stuxnet.

Ransomware doesn’t apply here and tends to depend on phishing first anyway.

Even terrorists have specific targets in mind.

So it’s either Bond villains or incompetence.

Edit: The only way i can fit your comment would be an incompetent script kiddy. Even then, doesn’t make sense as all systems were not directly attacked, as would be the case, but rather through what would have to be a side-channel attack, so no.