This is annoying without knowing the sources. But APT behaviours are repeated, researched, investigated. This could be legitimately mapped to a specific group using details which relevant agencies don't want to make public. Not sure we can deal with it better than acknowledge this is someone's opinion and there's a chance they may have more information, but there's also chance they're playing games.

A third possibility is that the attacker is pretending to be someone else as misdirection and that whoever is investigating fell into their trap.

This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, the attacker would also need to entirely suppress their own methods and approaches so that they are not identifiable as themselves.

Much easier to simply hide who you are by changing your compromise fingerprint than to try to impersonate someone else's compromise fingerprint.

If a technique is seen in this attack that has been seen in previous attacks which are now known to be by a russia-sponsored group, that is very strong evidence that the same group is responsible. It is not proof, but it is strong evidence.

If you know what the investigators are looking for (say, after you hacked them), then it might not be that hard.

Given the fact that attribution is so difficult that we haven't seen any lawsuits yet, I'd imagine that entirlely suppressing your own methods if you know what the investigator is expecting from someone else as well as what the methods of others are is feasible.

There were Russian characters in a comment in one of the scripts! Open-and-shut case!

As Obama told Romney years ago, "the 80s called and are asking for their policy back!".

American media loves their heroes and villains narratives, and the characters change depending on what is convenient. Even if Russia was responsible, would you believe them after all the other times they cried wolf?

For the same reason it has been the persistent narrative for the past four years.

"Anonymous source say...." is how just about every other Washington Post and New York Times article that turns out to eventually be wrong starts.

It's also how about every other WaPo or NYT article that turns out to be right works. Anon sources are the core of journalism, good and bad.

Seems to me that they have a `with good authority` hunch, but just need a few more pieces to make it a fool proof connection. With anything, unless they actively admit to it, or made a lot of mistakes, it's not really going any where. Does anything really happen to rogue nation Russia even if they are caught?

It's like getting a new, untrained puppy; it's one of those cases where, you walk into a dark room the puppy was in for a little while. You can smell it, and you're more than likely correct what it's coming from, you just can't see it so you can't really prove, yet, that there is shit somewhere... until you turn the lights on.

Maybe because it is believed (or known, or anywhere in between) that they are presently actively doing things of this nature...

Attackers also leave breadcrumbs behind; fingerprints, in a way. Sometimes the actions taken are the fingerprint, sometimes the effort to cover up those actions is the fingerprint.

If I am an investigator and I see trademark actions or cleanup that I've seen before in a russia-sponsored attack, it is not a huge leap to strongly suspect I am investigating a russia-sponsored attack.

And if you're a skilled attacker, wouldn't you leave breadcrumbs leading to someone else's door?

Like how North Korea is largely seen as responsible for hacking Sony. If you paint a big enough arrow, people will follow it.

Because Russia were legitimately a culprit during the cold war, and many people who grew up during that period are susceptible to clickbait where Russia is, again, the bad guy. They were primed for it during their entire childhood, and then as adults with movies, video games, etc.