My software is somewhat standard. Plain Debian or Plain Fedora.

I did not install any VPN software and used a generic wireguard file in network manager. I had chatted with the VPN owner who seemed nice. All VPNs involve a certain level of trust and the hack may not be related.

The router firmware is official manufacturer firmware, SHA256 verified, that probably does have unpatched CVE vulnerabilities because they are slow with firmware updates. I've considered moving the firmware to OpenWrt to reduce attack surface since CVEs are patched more quickly with OpenWrt.

I did not clean the keyboard at all. I do not believe I triggered keyboard shortcuts. I didn't spray anything.

The second (bad) laptop works fine after a reboot. I do not have the second hard drive plugged into it anymore and am not playing the FLAC files. Methodically testing again seems risky as the infection seemed to start in the second laptop, but not persist after reboot and unplugging the first hard drive. I'm concerned about damaging the Fedora laptop by testing.

I update via cron, everything was up to date in terms of packages.

VLC was in flatpak, it would have had to escape a sandbox to get out. VLC was recently updated.

I'm not that knowledgeable compared to someone who is a skilled hacker or developer. I've taken programming courses. I'm not that ignorant on these topics, but I'm not a real developer.

I was working on open source software that would have made it harder to do network correlation attacks. Probably no one would have cared, because I'm no one, but I am don't know for sure. Everything about this seems implausible to me.