The only reliable APT fingerprints I can think of are things that are hard, like forging real certs, SCADA malware targeting specific hardware, jumping airgaps, coordinated friendly media pushes for cover, etc. The "Russia did it thing" was pretty funny to watch. Very convenient way to not talk about the contents. It's well known where _that_ data came from, the xfer rates (among practical admissions elsewhere) support it. William Binney has it right as usual.