I think based of the Citrix vulnerability alone, there is only one group to look at
This is just tinfoil hat speculation of course lol.
When this Citrix zero day was disclosed to the public a few months ago, they mentioned nationstate actors.
It seems that Santa Clause is finishing up his naughty or nice list before rejoining the little lost island of elves with the rest of mainland North Pole.