I don’t think anyone would actually believe a US-affiliated organization would do this. It’s not their style. (unless you count some pro-US hacker/group doing it for the lulz)

But maybe that’s what they want us to think, and it’s actually counter-counterintelligence to make it look like an independent hacker/group...