Does it even matter? If you expose a vulnerable software to the open internet, it's gonna get hacked, and it doesn't matter if it's a script-kiddy from Russia, UK, or a North Korean spy. This was an ethically disclosed vulnerability, patched months before the incident in question. Update your stuff!