Which is another reason why attribution of cyber incidents is notoriously difficult. The CIA is hardly the only organization to put misleading evidence in thei

Which is another reason why attribution of cyber incidents is notoriously difficult. The CIA is hardly the only organization to put misleading evidence in their attack path. Also, countries like China and Russia have healthy malware ecosystems so a Chinese-written malware can end up in the payload of a {North Korean, Russian, Iranian} cyber attack. Personally, I'm starting to believe that the only way to have extremely high confidence in attributing an attack is to have surveillance of the person on the source keyboard when it happens or to have telecom evidence of people admitting what they did. Most of the actual attack is probably robotic at this point.