See my direct reply to you. There doesn't appear to be non-classified evidence that can attribute it (yet - at least available to FireEye/Mandiant). But member

See my direct reply to you. There doesn't appear to be non-classified evidence that can attribute it (yet - at least available to FireEye/Mandiant). But members of the US subcommittee on Cybersecurity have attributed it and asked for the evidence they saw to be declassified. Having said that, it wouldn't surprise me if in coming days it is able to be positively attributed from non-classified sources. This attack seems very widespread, and while it seems extremely professionally done in the past we've seen how small errors make attribution possible. Usually it's that an exploit developer reused some supporting infrastructure that has been previously seen and it can be attributed from that.