Well to be fair, I have read analyses that includes operational details like, for example, when the threat actors were active lining up with working hours in Ch

Well to be fair, I have read analyses that includes operational details like, for example, when the threat actors were active lining up with working hours in China. Stuff like that is at least slightly more convincing than just an IP But of course, that doesn't prove anything either.