So a couple things, I appreciate your patience and politeness. There is doubt. It isn’t clear exactly what is going on. However given the same sets of analysis tools that led us to Equation (US), flame, (Us), stuxnet (us, Germany, Israel), it becomes increasingly easy to identify at least general sources.
As I like to tell more junior members, it only takes one OPSEC failure to unmask who you are. And it only takes one OPSEC failure for nerd like me to figure out a bunch about the adversary.
There are bigger, more fundamental questions that havent–and likely won’t ever be–answered. But provenance is not one of them.
