Maybe because it is believed (or known, or anywhere in between) that they are presently actively doing things of this nature... Attackers also leave breadcrumb

Maybe because it is believed (or known, or anywhere in between) that they are presently actively doing things of this nature... Attackers also leave breadcrumbs behind; fingerprints, in a way. Sometimes the actions taken are the fingerprint, sometimes the effort to cover up those actions is the fingerprint. If I am an investigator and I see trademark actions or cleanup that I've seen before in a russia-sponsored attack, it is not a huge leap to strongly suspect I am investigating a russia-sponsored attack.