We have a rough timeframe: "To the best of our knowledge, the attacks happened between 2019–2021."

The hidden service targeted[0] had completely ceased to exist by April 2021, so that time range makes sense.

[0]: https://www.ndr.de/fernsehen/sendungen/panorama/aktuell/Inve...