It’s all explained here:
https://www.elliptic.co/blog/elliptic-follows-bitcoin-ransoms-paid-by-darkside-ransomware-victims
Smore about elliptic:
Crypto Wallet Screening
Quickly identify the owner of a wallet and its source and destination of funds through a simple browser-based interface.
(This is too easy!)
That explains private enterprise responding to and exposing hackers trying to launder, spend or cash out their extortion proceeds to protect Eliptic clients, but it doesn’t explain who originated, orchestrated or subcontracted the Exploit, or if it was False Flagged for Political purposes.