Following those links yield these two documents, which both have "Attribution" sections. Presumably some of these tell-tale signs were identified in the ongoing exploitation.
https://www.clearskysec.com/wp-content/uploads/2020/08/Dream...
https://securelist.com/operation-applejeus/87553/#attributio...
> One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actors usually focus on espionage only. North Korean money theft operations are carried out in service of the government, as a way of funding the nuclear program
Like, seriously? "You not only do espionage but also steal money, therefore you're NK"?
This is about WannaCry, but it shows how multi-source attribution is done.
Lol
In the real world you can't possibly fake every single code comment left in Russian as long as these comments make sense and there's enough of them. It takes a lot of effort to actually truly fake something, at certain point it becomes the same as completely doing the job itself in order to properly fake it.