Imo the siloing / rehacking smacks of multiple contractors being coordinated by a government agency.
The contractors don't want to share 0days, so the hack boundary handoffs between contractors seems apparent to me.
That would suggest US or Israeli sourcing, or maybe Saudis who are eager buyers of Israeli hacking products