112-123
You are correct that the publicly available evidence doesn't point directly to the GRU, but rather merely to an anonymous extremely well-resourced group whose interests align extremely well with Russian military interests. While the GRU is the most reasonable conclusion, this would leave open, for example, the possibility that some contractor to the Russian military is operating with independence, not actually under direct order from the Kremlin.
The intelligence community claims to have knowledge, through conventional intelligence rather than forensics, that this was done by the GRU themselves, under order from the highest levels of leadership. This presumably means they know who the hackers actually are, whom they report to, and the general structure of the agency. They claim they have multiple, strong, independent sources confirming this, but they can't reveal their intelligence publicly without compromising those sources.
Wikileaks is implying -- heavily enough that every news article I've seen mentions it (some, even, without the "might" or "could") -- that the main reason the CIA would support Unicode is so that they can trick people into thinking they're Chinese.
Mentioning (the quite obvious fact) that it's possible to include foreign text in code as an effort to confuse adversaries, while discussing an actual implementation of text obfuscation, will confuse reasonable people who lack the technical understanding of what this is into thinking the software obfuscates text by somehow changing the language it's in.
Here's a more egregious example:
This doc (https://wikileaks.org/ciav7p1/cms/page_13763790.html) contains one line "Vehicle Systems (e.g. VSEP)." It doesn't elaborate what "Vehicle Systems" they mean or define "VSEP," but given the other projects worked on by the same team (all using embedded systems to spy on you), the most reasonable interpretation to me is that they'd be trying to intercept GPS and other sensor data, including voice and video from cameras and microphones.
Wikileaks wrote "As of October 2014 the CIA was also looking at infecting the vehicle control systems used by modern cars and trucks. The purpose of such control is not specified, but it would permit the CIA to engage in nearly undetectable assassinations." In this case, they added the word "control" from nothing, making the completely unsupported claim that the CIA is investigating the possibility of assassinating people by hacking their cars (which, hey, might be true... but there's nothing supporting that idea here).
Sure enough, dozens of article were written about how the CIA is killing people by driving their cars off cliffs.
It's based on the re-use of the same exact techniques, including command-and-control server addresses and encryption keys that have been used in many, many other attacks that align extremely closely with Russian interests.
Successfully hacking, over the course of about a decade, American government interests, Eastern Ukrainian militias, Russian dissidents, the Olympic anti-doping committee investigating Russia's wide-spread doping scandal, journalists investigating the downing of MH17, etc. would be a very convoluted and expensive way to spoof attribution of this one attack.
> The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion
There's no evidence the CIA has ever done this. This is pure conjecture based on the fact that there's demo code showing that the library supports Unicode.
They're pretty obviously trying to push the idea that attribution of hacks (such as the DNC hack) can be really easily spoofed, and you shouldn't trust them. And it's working:
https://www.rt.com/news/382940-wikileaks-vault7-marble-frame...
http://www.mirror.co.uk/news/world-news/-wikileaks-vault-7-m...
http://www.dailymail.co.uk/news/article-4367746/WikiLeaks-sa...