To be honest, I’m less worried about the person(s) behind the alias. It can be anybody at this point.

Maybe it’s China? Or maybe it’s Russia using Chinese VPNs and aliases? Oh wait maybe it’s Israel…

These are questions that the political asshats down in Washington DC ask every time shit like this happens. It’s almost always inconclusive.

I would rather focus attention on what can be done to improve software supply chain security.