By making an offer via the Motherboard website, that they would decrypt files which were encrypted during an attack for 100 Bitcoin (US$250,000), the attackers have brought the narrative back to ransomware.

Security firms initially concluded that the malware used in the attack — which has been variously named Petya (nomenclature given to ransomware that already exists), NotPetya, ExPetr, Nyetya and GoldenEye — was ransomware.

They later said that it was a disk-wiper as in many cases it was wiping the master boot record of Windows computers making the machines unbootable.

This, plus the 100 Bitcoin decryption offer, only means one thing: that the attackers are trying to shift the narrative from that of being a nation-state attack to one of being just run-of-the-mill ransomware, though on a much larger scale than usual.

The effort to create confusion in the minds of researchers was highlighted in this iTWire report about the findings by F-Secure.

One of its researchers, Andy Patel, was left scratching his head and asking: "At the end of the day, if someone wanted to build a 'wiper', why build an almost functional ransomware, save for a few bugs and a possibly misconfigured final package?"

Patel posed this query after he found that while the encryption-decryption code for the master boot record did not work, the code for carrying out the same function on system files was working.

Whether the attackers succeed in sowing doubt in people's minds about the nature of the attack — ransomware or a nation-state effort to destroy data — will depend on how many media outlets blindly repeat the story that was published by Motherboard without questioning the motives behind the attackers' move.