Which country or groups are suspected to be behind major ransomware attacks?

How have companies that faced ransomware attacks managed recovery, and what lessons can others learn from their experiences?

What are the most effective ways to protect personal or organizational data from ransomware attacks, including proactive strategies and reliable tools?