You tend to comment "it's war mongering" and how nobody actually knows who the attackers are, but you seem to say this out of alliance with no technical background in how these connections are made.
The naming of ethnicity/nationality in articles like these seems governed by "geopolitical" tides.
There is no way there is some forensic way to figure out where somewhat competent hackers are from.
Last time they identified the hackers, those guys changed their "signatures" AKA the things they did to give themselves away.
Even the best hackers etc slip up.
The exact method to identify them is irresponsible to reveal because the malicious party will use it their advantage.