I'm very curious how we can attribute a threat to a particular nation state, given pretty much anything in code/IP/modus operandi/etc. can be faked by one party to look like another. I went through both links and all I found was a lot of hand-wavings like

> One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actors usually focus on espionage only. North Korean money theft operations are carried out in service of the government, as a way of funding the nuclear program

Like, seriously? "You not only do espionage but also steal money, therefore you're NK"?

I've posted this elsewhere, but https://www.justice.gov/opa/press-release/file/1092091/downl...

This is about WannaCry, but it shows how multi-source attribution is done.

Thanks, this seems much more detailed. I'll give this a good read.

Its hilarious that neckbeards think that NK hackers are top class. Yeah maybe they can hack here and there but anything complex is developed by TAO/the Equation Group/ Israelis

Lol

> I'm very curious how we can attribute a threat to a particular nation state, given pretty much anything in code/IP/modus operandi/etc. can be faked by one party to look like another. I went through both links and all I found was a lot of hand-wavings like

In the real world you can't possibly fake every single code comment left in Russian as long as these comments make sense and there's enough of them. It takes a lot of effort to actually truly fake something, at certain point it becomes the same as completely doing the job itself in order to properly fake it.