One starting point is the domain the 'hackers' used in those tweets. It's inaccessible now, but a great starting point for further investigation. You would need pretty strong OPSEC to register a domain anonymously these days, even with so called 'privacy aware' registrars like Njalla et al.