3 ms·

Usually they compare found samples with samples used in other attacks. So they can assume that they were made by the same group.