It's easy to say "basically zero chance" when we're armchair quarterbacks and not the ones in the hot seat.

I'm inclined to agree that our cyber-security apparatus is not up to the task, but it's also true that nobody has perfect OpSec, (and I'd guess there are few out there have deeper pockets to track down and make sure the perpetrators regret this, than the combination of US government + oil companies.)

This isn't the first such attack. You can bet the big agencies worldwide have been aware of ransomware and investigating. They have been putting evidence together. It only takes a few of the right mistakes on the part of the criminals for them to be figured out. In the long run the advantage is to the police because they can keep looking.

If you want to be a criminal who gets away with it you really need exactly one big action, and at most a few tiny practice runs before the big one. Choose your target well because once the big one is done you have to be done. (and don't do anything copycat - investigations to get the first guy might find you instead)

> nobody has perfect OpSec

Yep. Compromised people on the inside, informants, "intensive interrogation" etc. are more likely the way, as has always been the case.

Also the agencies that would know who these people are would not want to reveal what they know in order to save random XYZ Corp's bacon. With this being seen as a "critical infrastructure" attack and something closer to an act of war/terrorism, the stakes got higher.

There have been hundreds of ransomware attacks. How many of them were arrested? Many of them caused more damage than this one.

The US government has a long reach, but even they cannot do anything to you if you are in Russia, for example.