> I'm just wondering what the hell a "signature" is in this context? If you genuinely don't know how companies like FireEye do attribution then one has doubt t

> I'm just wondering what the hell a "signature" is in this context? If you genuinely don't know how companies like FireEye do attribution then one has doubt the level of insights you have. Notably in this case FireEye said they COULD NOT attribute the attack to any group initially: "FireEye wouldn't confirm the APT29 attribution and gave the group a neutral codename of UNC2452, although several sources in the cyber-security community told ZDNet the APT29 attribution, done by the US government, is most likely correct, based on current evidence" https://www.zdnet.com/article/microsoft-fireeye-confirm-solarwinds-supply-chain-attack/ https://www.zdnet.com/article/microsoft-fireeye-confirm-sola...