Their high-confidence attribution to NSO Group is described as being based on two factors:

1. Incomplete deletion of evidence from a SQLite database, in the exact same manner observed in a previous Pegasus sample;

2. The presence of a new process with the same name as a process observed in a previous Pegasus sample.

But isn't it likely that someone with the skills needed to discover and weaponize a chain of 0-day exploits, is incentivized and able to detect these quirks in Pegasus samples and imitate them, with the goal of misattribution?

Of course, there may be more factors involved in the attribution that aren't being shared publicly.