I'm not yet done with all comments, but so far I've not seen anyone defending Russia, just asking for evidence or at least indicators. Proper attribution of hac

I'm not yet done with all comments, but so far I've not seen anyone defending Russia, just asking for evidence or at least indicators. Proper attribution of hacks isn't exactly a trivial and foolproof thing. There is a big asymmetry here: On the one hand this whole "cyberattack" boils down to a) the password for the build server being <companyname>123 and b) publishing said password on github. The customers, federal agencies including intelligence, failed to find this for a year, which simply is gross incompetence. I mean really: Did the agencies integrate this software into their critical systems without any checks? Yet these agencies are at the same time so competent that they can reliably attribute usage of the password (this wasn't even a hack) to the Russian government within days? Edit: It is of course quite possible to be Russia, but hacking is comparatively cheap, so the list of possible culprits is larger than just Russia and China. It could also be way more than just one country, as the password was public for everyone to use for almost a year.