The group named across several incidents in the period appears in unrelated sectors, from education to retail, and the common trait isn't the sector: it's the type of system attacked.
The method is recognisable. Rather than choosing companies by market value, you choose platforms by customer count, because compromising one point yields access to many environments for the same work.
That explains the apparent randomness of the victim list. They have nothing in common with each other; they have a supplier in common, and frequently don't even know who else uses the same system.
For defenders, that characteristic is the hardest to manage, because exposure doesn't depend on your own decisions. It depends on the security posture of a third party you can't audit and whose customer list you don't know.
The measures that work are about containment rather than prevention: reduce the scope each integration reaches, require notification deadlines in contracts, and assume in the design that a connected integration can become an entry path.