The attacker would probably want to keep the exploit hidden, thus probably restricting themselves to data exfiltration rather than outright obvious attacks. Considering that’s it’s a state actor, perhaps people arrested and dark web sites shut down.