The author of the 'xz' backdoor commit history and activity shows that they kept office hours mostly. Mon-Fri, every other Saturday, I would imagine some of these would correlate with public holidays as this was clearly not a hobbyist.
https://github.com/JiaT75?tab=overview&from=2023-12-01&to=2023-12-31
SOURCE: https://x.com/hackerfantastic/status/1773864354439417983
