Further development:
Crowdstrike post: https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-... (https://news.ycombinator.com/item?id=50003578)