How do they know they’re Chinese? If they’re doing something as dumb as using a Chinese IP or entering Chinese text, why not just ban China/Chinese characters
https://www.mandiant.com/resources/blog/vmware-esxi-zero-day...
The heuristics used by security researchers are not really based in externals as you suggest. There is significant energy devoted to classifying and categorizing threat actors, and the main takeaways here are (1) nation-state-level power/funding and (2) not on our side.
If Mandiant said they caught a Chinese hacker red handed by tracing the connection to his house in Beijing, and they were able to record his keystrokes, would you believe them?
When Kapersky said they discovered zero days by US intelligence, they gave no evidence either:
[FSB] goes on to claim without evidence that the attacks amount to a plot between Apple and the NSA to build a powerful surveillance infrastructure to snoop on those with ties to Russia.
https://www.darkreading.com/endpoint-security/apple-zero-day...
Probably
> When Kapersky said they discovered zero days by US intelligence, they gave no evidence either
I listened to the Kapersky talk. They didn’t attribute it to anyone. The FSB is not Kapersky. No, I don’t believe the FSB precisely because they have no evidence.
The naming of ethnicity/nationality in articles like these seems governed by "geopolitical" tides.
There is no way there is some forensic way to figure out where somewhat competent hackers are from.
Last time they identified the hackers, those guys changed their "signatures" AKA the things they did to give themselves away.
Even the best hackers etc slip up.
The exact method to identify them is irresponsible to reveal because the malicious party will use it their advantage.