>Also both the powershell and the py2exe are completely reversible so you can take it, modify it and who's creation is that now?

What about X-Agent? Seems like it would be harder to modify but I haven't looked into it.

>On top of that, it's entirely possible other completely unrelated attack is responsible for the leaks, but the malware used cleaned up after itself, leaving only the less sophisticated trail behind.

I like this point but it could be brought up in nearly all attributions.