@pluralistic Mind you that attribution is difficult, and everybody in this sort of attack operates under a cover that is easily misattributed.

It could be anybody. The one it is most likely not is the one attributed.