The author hasn't laid out all of the evidence in the article, but they mention some of the factors which they probably used to identify the actors involved: 1

The author hasn't laid out all of the evidence in the article, but they mention some of the factors which they probably used to identify the actors involved: 1. Explicit identification. Tor relays, including exit nodes, are identified by contact information. Many of the groups of malicious exit nodes shared contact information. 2. Benign behavioral identification. Many of the identified malicious exit nodes were deployed on the same service providers, including some obscure ones. This isn't a definitive identifier, but it helps link explicitly identified groups. 3. Malicious behavioral identification. Many of the malicious exit nodes were performing similar attacks on outbound traffic, like sslstripping traffic to cryptocurrency web sites. The exact parameters of this behavior (e.g, which sites were targeted, what modifications were made to cleartext data, etc) weren't laid out in the article, but would serve as a highly accurate fingerprint for a specific attacker.