By analyzing payloads / C2 address, etc...
Yeah because a state level actor would be completely incapable of false attribution.
Yeah because a state level actor would be completely incapable of false attribution.