1. Maybe they spent less money attacking Mastodon. I have no idea.
2. https://bsky.app/profile/safety.bsky.app/post/3mjg52nusg226 (and the actual lede of the story in the NYT)
3. Different networks, different pain points. The exact same APT is attacking Mastodon and having a far more successful time of it. It's not being reported because unlike influential accounts being hijacked, a paltry few thousand fake Mastodon accounts spewing propaganda is not considered newsworthy.