Cybersecurity firm Mandiant has identified this threat actor as "UNC3886". https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass https://www.mand

Cybersecurity firm Mandiant has identified this threat actor as "UNC3886". https://www.mandiant.com/resources/blog/vmware-esxi-zero-day-bypass https://www.mandiant.com/resources/blog/vmware-esxi-zero-day... The heuristics used by security researchers are not really based in externals as you suggest. There is significant energy devoted to classifying and categorizing threat actors, and the main takeaways here are (1) nation-state-level power/funding and (2) not on our side.