They're currently designated as UNC6240, so there's not a lot of publicly available information on them yet. From what I understand about the Salesforce Data Exfiltration campaign (C0059), only the extortion demands were attributed to them and I'm not sure whether that was purely opportunistic or a deliberate collaboration.
They're currently designated as UNC6240, so there's not a lot of publicly available information on them yet. From what I understand about the Salesforce Data Exfiltration campaign (C0059), only the extortion demands were attributed to them and I'm not sure whether that was purely opportunistic or a deliberate collaboration.