No one. It was organically detected by the threat hunting team at a cybersecurity company called SentinelOne.

Most cybersecurity vendors have a dedicated org to threat hunting and blue teaming for a mix of marketing and keeping parity with exploit developers.