Tool use, essentially. Of course that could be spoofed, but I think that's the origin of the claim.

https://www.reuters.com/article/us-global-cyber-solarwinds/s...

Tools can be stolen. In fact, if we're claiming whoever did this was a super-genius, they would have stolen or spoofed the tools they used to point at someone else. Unless they were Russia being so clever they were pretending to be someone pretending to be Russia!

Edit: Your link show Kaspersky labs making the claim that this was the FSB. Yet the West also claims Kaspersky is controlled by FSB! Well, you could say "they should know". Or maybe they want to humor the West so their ban will be lifted. Or maybe they aren't controlled by the FSB at all. But if the West can't figure that out, how do they expect to figure out the true origin of the hack.

"A riddle wrapped in mystery, inside an enigma"

I worked for Crowdstrike. We did this hack as our primary demo. Dmitri is on the Atlantic Council along with the rest of the Obama team. There is no more evidence to suggest Russia was involved than there was that Dmitri himself was for political reasons. And Shawn Henry will fire you for saying this out loud.

There has been considerable coverage of this attribution: https://ciexinc.com/blog/solarwinds-articles/attribution.htm...

The reply from ipsin was much more helpful. This list is mostly full of articles in general about the Solarwinds attack and others including "Supernova malware clues link Chinese threat group Spiral to SolarWinds server hacks (ZDNet)".