This comment is a key example of what I’m talking about: Researchers and analysts don’t just look at where the physical address of the packets came from when le

This comment is a key example of what I’m talking about: Researchers and analysts don’t just look at where the physical address of the packets came from when leveling an accusation as serious as nation state attacks. They take into account things like previously known threat actor capability, nation state actor characteristics, malware specialization, enumeration and exfiltration toolkit, command and control infrastructure, and finally motive. When coming from an industry giant that’s been working with US intelligence groups, it’s really a rigorous process.