>Update: PC Mag says it's probably based in Russia.
Which from the evidence of the various Climate hacks in 2009 and the Stuxnet trail, is just a cover address for some operation based in the US...
Which given the seeming maturity etc of the ransomware infrastructure, does suggest it might share a parentage with Stuxnet...