Maybe I misunderstood your original post. I thought you were asking about the risks of regular people being able to gain NSA-like abilities if NSA tools manage

Maybe I misunderstood your original post. I thought you were asking about the risks of regular people being able to gain NSA-like abilities if NSA tools manage to fall into their hands. I think that's not a huge risk, beyond zero-days. However, yes, a very dedicated, very smart group of blackhat hackers could probably achieve somewhat similar things as an intelligence agency's hacking division. You don't necessarily have to be a government to be an APT. There are still other advantages, though. For one, at NSA, you can do anything you want with legal impunity, while a blackhat might be imprisoned for doing the exact same thing. Also, you have access to a huge organization and various things they've already embedded themselves into, like backdoors and internet traffic taps. So, they do have an inherent advantage, even if the people involved aren't necessarily inherently better hackers. (Though they may be, if they're better at hiring than you are at recruiting for your private organization.) Given enough time and effort, a private group could maybe also embed themselves in a lot of places, but they're all at the mercy of their governments and allied governments, and may constantly risk arrest. In terms of this particular incident, I believe it absolutely could be either a government or a private whitehat/greyhat/blackhat individual or group.