They’re currently designated as UNC6240, so there’s not a lot of publicly available information on them yet. From what I understand about the Salesforce Data Exfiltration campaign (C0059), only the extortion demands were attributed to them and I’m not sure whether that was purely opportunistic or a deliberate collaboration.

I was also stuck on Asahi, mainly because many of the attributes associated with it in the JSON file are wrong. Surely it’s based on Fedora, not Arch?