But members of the US subcommittee on Cybersecurity have attributed it and asked for the evidence they saw to be declassified.

Having said that, it wouldn't surprise me if in coming days it is able to be positively attributed from non-classified sources. This attack seems very widespread, and while it seems extremely professionally done in the past we've seen how small errors make attribution possible.

Usually it's that an exploit developer reused some supporting infrastructure that has been previously seen and it can be attributed from that.

I have no specific knowledge, but essentially, most of the evidence is likely to be circumstantial, with chains of inferences from co-occurences of targets, tools, techniques, and other 'fingerprints', various bits of which may occasionally be confirmed or refuted by humint (which may or may not be reliable).

It is very unlikely that there is any single piece of info that definitively ties the attack to a particular actor (except maybe sigint), and with sufficient effort a false-flag operation can successfully lead to a mistaken conclusion, at least temporarily, but that's harder than it seems.

Any actor that tries to imitate the signature of a different actor by only using stuff from the other guy's bag of tricks is by definition only using tools that have been detected and are known; which means that countermeasures are likely to also be known and in use. Adding anything novel on top of that to increase the chances of the attack's success is incorporating a signal that WON'T be present in the chosen fall-guy's future efforts (unless previously undetected tools can be stolen from the fall-guy), which may (eventually) undermine the desired conclusion.

Figuring out whodunnit requires an essentially Bayesian approach, except the data is usually circumstantial, and priors - themselves always contingent on even earlier data - are of uncertain reliability and must when possible be tested against later assumed-reliable data from other channels for consistency (and when inconsistent, deciding whether new data trumps priors or vice-versa is a bitch).

Nevertheless, given how much data there typically is, it isn't too often that something comes along (like the discovery of a mole, which invalidates assumptions about what the opposition knows, and knows you know, etc.) to upend everything and break or reverse whole chains of inference.

So, while we might eventually find out some of the circumstantial evidence that lead to the attribution to a particular actor, we won't ever be told what other previous evidence (itself circumstantial) ties that evidence to that actor. Eg. "Toolchain X used in this attack is linked to Actor Y, but we can't tell you how we know they are linked. Sorry-not-sorry." ¯\_(ツ)_/¯

The GOP and right wing types traditionally pulled a hard line against Russia and Russian interest. Then that softened — remember George W Bush “staring into Putin’s soul.” Conservatives picked up an infatuation of sorts with Russia early in the Obama administration. Talk radio personalities took a shine to Mr. Putin because Russia allowed transit of US troops and supplies on Russian railways to Uzbekistan, for example. Policy positions on Syria we’re strange.

It flipped to obsequiousness mysteriously in 2017. Anything critical of Russia suddenly became a tangle of whataboutisms and other nonsense. Old hawks now roost as Russia doves. Senators who are ok with child separation want pardons for Edward Snowden.

We've also seen them just fabricate things out of whole cloth, e.g. Iraq WMD.

It's generally best to read "according to sources in the intelligence community" as "according to professional liars who are aware you have no way of verifying anything they tell you."

Also keep in mind that revealing real classified intelligence to the media is a federal crime but making stuff up is totally legal.

His tweet is referenced in the same article ([1] above) if that's what you mean?