>It behooves IDS vendors to make people think that nation-states are regularly trying to invade their systems and it's free publicity to come out and corroborat

>It behooves IDS vendors to make people think that nation-states are regularly trying to invade their systems and it's free publicity to come out and corroborate the mainstream narrative, so they play along/feed into it and say "Yeah it was definitely the Russians even though there's no way we'd actually know that since our software wasn't installed until after-the-fact". This is especially blatant with the follow-on firms that just wanted to cash in on the available PR by saying "uh, yeah, we detected that too". There is precedent for security vendors falsely claiming that nation states are responsible for some attack when it actually wasn't. However, in this case top security vendors in direct (and sometimes aggressive competition) with each other are in total agreement, as is every public statement from the intelligence community. Now, of course, it is in the US government's interest to paint Russia in a bad light, so claims alone aren't enough here. But look at the actual investigative trail ThreatConnect and CrowdStrike presented, and compare it to the past ~5 years of activity from what are almost definitely the same actors, and it's hard to believe they're anything other than a Russia-affiliated group.