Forensics and attribution are big parts of the infosec world. Researchers study attacks, tools, payloads, etc. and get an idea of different threat actors, their

Forensics and attribution are big parts of the infosec world. Researchers study attacks, tools, payloads, etc. and get an idea of different threat actors, their levels of sophistication, and who might have done which one. I’m sure it’s never ironclad - the conclusion that it was a particular intelligence agency is just an educated guess, and sophisticated attackers might intentionally ape the signatures of others. But it’s not completely hopeless.