I think that they got caught so easily, suggests it just the work of one person.

Nation states usually work in teams, and damn good ones. In fact it was suspected one of these groups have done something like this before.

https://intezer.com/blog/malware-analysis/new-linux-backdoor-redxor-likely-operated-by-chinese-nation-state-actor/

They also tend to create their own library's and obfuscate and hide it much better by doing that.