whats the misdirect? is it not true a state would not try to obfuscate the who is doing the attack? so Microsoft telling us its "X" without direct physical evidence is bs to me. Even the NSA intercepts network equipment orders and installs backdoor before sending them back to being delivered... now your hack is coming from "X" but it was done from "Y" using that hacked router etc, you get the picture? how can you know who did what?

Yes, but that is almost as true for foreign groups as domestic ones.