I did my own research. If you look at the git repository commit log and some mailing list messages, you will see that the author ("Jia Tan", fake name) speaks impeccable English (already lessens the chance of being a Chinese operative), however he commits in the +0800 time zone (Beijing). He works during Chinese holidays and doesn't work during Western holidays.
However, the times don't make sense: It looks like he works mostly at 2am: https://files.catbox.moe/6mdtez.png (hours in the +0800 timezone). I understand this to be indicative of using a different timezone on the computer than where he actually worked, possibly knowing that git commits include the timezone.
If you shift the timezone to US East Coast -0400, it suddenly looks like a very comfortable full-time job, including a fall in commit rate right where the lunch break should be: https://files.catbox.moe/dtvjzr.png
To me, considering that this appears to be a nation-state tier attack, heavily indicates that it was the Americans. Obviously not conclusive proof, but I think it is useful evidence.
However, the times don't make sense: It looks like he works mostly at 2am: https://files.catbox.moe/6mdtez.png (hours in the +0800 timezone). I understand this to be indicative of using a different timezone on the computer than where he actually worked, possibly knowing that git commits include the timezone.
If you shift the timezone to US East Coast -0400, it suddenly looks like a very comfortable full-time job, including a fall in commit rate right where the lunch break should be: https://files.catbox.moe/dtvjzr.png
To me, considering that this appears to be a nation-state tier attack, heavily indicates that it was the Americans. Obviously not conclusive proof, but I think it is useful evidence.