Surely you're able to tell the difference between "our servers were attacked by this widely available toolkit, so we have no idea who's behind it" and "Dutch police find 4 Russian guys with diplomatic passports, in a Lada with WiFi antennas directed at the Organisation for the Prohibition of Chemical Weapons headquarters"?