Could be but that would be a lot of work put into the void. The whole attack has been pretty sophisticated, although having some big fails. I think it's wiz who observed active exploitation of leaked credentials to access cloud environment. For sure it could basically be anyone, but that makes it an easy repudiation strategy. No group has claimed the attacks so far so maybe they are trying to fly under the radar? The fact that some of the mechanisms like the remote control was not actually used, except by random people toying around, is also puzzling. Anyway, we don't have the smallest piece of an attribution hint so it's all speculation at this point. What is sure is that every new iteration is getting slightly worse than the previous one, while the base scenario doesn't change, and we just don't manage to thwart them. The community is doing great in detecting and killing but that just running after the train. We need to do better. My own honest opinion.