The attack in question was reportedly in 2022, and while we can imagine there's a plausible way they might have figured this out (via analysis of published Operation Triangulation infrastructure from Kaspersky), there are (seemingly) unfortunately no IOCs available at this time
