> I’ve only talked to a small number of victims. They are orgs with interests in East Asia. Activity appears very targeted.

Notepad++ has a reputation for highly ethical social stances. As well as being a good target given how widely it's used in tech, I wonder whether they're a target given their social position. That includes using them to target other orgs which may be active supporting social or political activities, ie, attackers may see N++'s stance as meaning it is more likely to be installed by other groups they really want to target.

Activities 'in East Asia' are especially notable given the history of advocacy for the Ughyurs, freedom in Hong Hong, and similar.