Guessing NSA, but some of these kinds of trojans and 0-days are kept silent until needed. Usually when you do an attack with a vector like this, you can do some analysis afterwards and see exactly where the backdoor is.

I think that they got caught so easily, suggests it just the work of one person.

Nation states usually work in teams, and damn good ones. In fact it was suspected one of these groups have done something like this before.

https://intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/

They also tend to create their own library's and obfuscate and hide it much better by doing that.