Re:A Voice Cuts Through, and Adds to, the Intrigue of Russia...
by rlucas on Thursday September 29, 2016 @11:37PM
(#12610401)
Most of what I've heard of being used as support for attribution are "fingerprints" left behind on compromised devices. Things like characteristics of how variables were named in interpeted code, how binaries were compiled, specific attack vectors used, etc. I can't recall anyone recently pointing to first-hop originating IPs as being definitive evidence, in this age of cheaply traded botnets.
The US probably has hacked Russian communications from somewhere else that actually points the finger. However, they would never give that information up.
Either that or they have hacked a huge chain of these proxy operations, but that seems like a tall order.