> They take into account things like previously known threat actor capability, nation state actor characteristics, malware specialization You mean they pin it

> They take into account things like previously known threat actor capability, nation state actor characteristics, malware specialization You mean they pin it on whomever they want to. It's all meaningless. It's like telling how someone voted from their shoe print.