[foverzar]

It is based on various attribution factors. But since it is typically easier to point at the currently hated scapegoat and be done with it, the quality of these attribution factors leaves much to be desired.

E.g. https://blog.sekoia.io/noname05716-ddosia-project-2024-updat...

"The decision not to mandate VPN usage in Russia, especially given their statement “it is extremely unlikely that there will be any problems”, suggests a possible collaboration between the NoName057(16) group and the Russian state."

I imagine you've also heard of attributions like "Cyrillic layout" (used all over eurasia) or "IP pool associated with a Russian AS" (as if VPS renting isn't a thing or commodity routers in Russia aren't hackable and can't be forced into a botnet)