If this checks out, it's very surprising. I would assume they wouldn't have the skills for pulling out something so massive like this.
The more complicated part was the propagation via the exploit, but at the same time the exploit was already out in the open. That was part of the reason it only infected old or non-updated machines. So still not easy, but a good chunk of the initial work was done for them.