And this is what kind of indicates it was not state sponsored.

Won’t be really surprised if an IT Cell team lead unwittingly handed over control of the account to an enterprising cousin for a while :D