As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically

As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.