There’s another nice example of attribution, in a recent piece by Brian Krebs [krebsonsecurity] “Who is Anna-Senpai the Mirai Worm Author?” I’m not going to walk through it in detail, because Krebs has already done that very well.
It’s a good example of how to do attribution of an attack; the $30+billion/year US intelligence community should be able to do as good a job as a blogger like Krebs, don’t you think?