No one. It was organically detected by the threat hunting team at a cybersecurity company called SentinelOne.
Most cybersecurity vendors have a dedicated org to threat hunting and blue teaming for a mix of marketing and keeping parity with exploit developers.
Do they aim their "organic detection" equally against every single country, including the US? Or are they inherently biased?
That's rather bad faith.
Not really. It’s human beings who choose who to focus on and with how much scrutiny, who decide on what to follow up on when given a list of hits, etc. All humans act based on the political climate and it’s naive to think otherwise.