In an otherwise well written and accessible article, I found the naming of example nations gratuitous: > some researchers believe only a nation with formidable hacking chops, such as Russia or China, could have attempted it. … or the US, UK, Israel, Germany, France, Canada, Australia, DPRK, Japan, etc, and the security offence companies that work as a supply chain for such nations in provision of embedded exploits. I…
For me the names "Hans Jansen" and "misoeater91" also rule out China. I think it's Israel or USA or Russia. Apparently the 6 accidental timezone slip-ups in the commit history would be compatible with Israel or Russia, although can't even rule out that those are there on purpose to throw us off the scent...
Israel has shown in the past, with Stuxnet, that they have the skill, the patience, and the will. Same for Russia with Solarwinds.
If Jia Tan was using a FIDO/U2F key, it would be nice if someone would publish its public component so others can check for any traces of its use, but I honestly don't know how those work and whether such is even possible.
[Edited to add Russia to my personal list of countries I suspect. Something about the "misoeater91" name kinda suggests Russia to me somehow...]