Agreed, but this seems to be one of the cases where we got more than that. I don't have time to read the indictment in a ton of depth, but it tells a very detailed story about some of the hackers and how they organized the hacking; it's not just "the IP matched so it's gotta be them".

> There is such a thing as real attribution. Just not from IPs and tools that are easily faked. You need more than that, and indeed there were many cases were we got more than that.

And there are most likely a lot of cases where:

1) "...we got more than that," and...

2) ...data from "IPs and tools that are easily faked" is the only information that could be released publicly without compromising sources and methods.

It's a hopeless wish to want to be able to independently assess (as an amateur!) intelligence findings in all cases. If trusting the official assessments isn't acceptable (cross-checked with general knowledge of the situation), about the only reasonable alternative position is to remain agnostic.