At the same time in this case I would be more surprised if the PRC , since their need for control, and since the stakes are extremely high, wasn't doing such things.
If I ever code a hacking tool I'll throw in some Korean comments for sure.
Instead, you get tribalist arguments over who believes which secret police.
Instead I found an article on Wikileaks claiming CIA executed false flag hacking operations: https://theintercept.com/2017/03/08/wikileaks-files-show-the...
The CIA is hardly the only organization to put misleading evidence in their attack path. Also, countries like China and Russia have healthy malware ecosystems so a Chinese-written malware can end up in the payload of a {North Korean, Russian, Iranian} cyber attack.
Personally, I'm starting to believe that the only way to have extremely high confidence in attributing an attack is to have surveillance of the person on the source keyboard when it happens or to have telecom evidence of people admitting what they did. Most of the actual attack is probably robotic at this point.