[rlucas]

Most of what I've heard of being used as support for attribution are "fingerprints" left behind on compromised devices. Things like characteristics of how variables were named in interpeted code, how binaries were compiled, specific attack vectors used, etc. I can't recall anyone recently pointing to first-hop originating IPs as being definitive evidence, in this age of cheaply traded botnets.

[ww520]

Code and tools can be bought and sold.

[ethanbond]

Arms dealers are still implicated into the crimes committed with said arms. Both the CIA and KGB/FSB should know that by now.