Can someone explain
I don’t get this idea that “it is a really sophisticated attack, so it must have been a government”
Have they ever seen what government IT is like?
Of course logging in over ssh with “password” as the root password counts as a sophisticated attack, but that is a whole different story.