That said it would be a feasible yet simple story to fabricate. The details aren't that important, just saying "we found a file with ip addresses that had services open with no password" is plausible but also not that specific.

Seems like all they need to do is publish their communication now that the vulnerability has been fixed?

A bunch of hackers in Sweden. You can pay without exposing any information about yourself and they support wireguard (even help pay for and doing their own development on it).

I meet some of them personally on hacker conferences as well and they knew what they were talking about.