These people are incredibly smart. https://link.springer.com/article/10.1186/s42400-020-00048-4 https://link.springer.com/article/10.1186/s42400-020-00048-4 htt

These people are incredibly smart. https://link.springer.com/article/10.1186/s42400-020-00048-4 https://link.springer.com/article/10.1186/s42400-020-00048-4 https://www.blackhat.com/html/webcast/07072020-how-attackers-confuse-investigators-with-cyber-false-flag-attacks.html https://www.blackhat.com/html/webcast/07072020-how-attackers... TLDR. > They highlight that not only malware samples and their specific properties (such as compiler settings, language settings, certain re-occurring patterns and the like) are useful, but also information available outside the actually attacked infrastructure, including data on the command & control infrastructure. Yes you can obfuscate certain things, buts its hard to obfuscate EVERYTHING, and if you dig deep enough, you can make a decent effort finding the owner.