AFAICT, they aren't tor nodes or VPNs, so they're part of the infrastructure the #ransomware group uses, most likely infected machines because despite their mistakes I don't think they'd expose *their* IPs.
But what's significant *is* the lack of tradecraft and sophistication.
This #ransomware group isn't big, but in the past few months they've publicly claimed a few dozen victims and leaked files for about a quarter of them, small batches for each.
They show few signs of technical sophistication. The companies they've hit don't care about that.
NEW: It took four years but I just got some newly declassified CIA reports studying the Soviet Union's use of "black magic", telepathic mind control and "psychotronic generators" – devices they said turned people into psychics and let them move objects with their minds. #FOIA
CIA originally denied the request, refusing to confirm or deny the existence of the records by citing "intelligence sources and methods" but we won't read too much into that