Which classes of attribution evidence are hardest for an adversary to fake, and which are easiest? How does that change how you weight them?

The ranking runs roughly inverse to how easy the evidence is to collect, which is the uncomfortable part.

Easiest to fake, and therefore weakest: language and locale artefacts, build timestamps, code comments, keyboard layout indicators, and planted strings. All of these are trivially manipulated, and they are manipulated deliberately. Deliberate reuse of another actor's tooling belongs here too.

Weak on its own: shared IP addresses and hosting. Bulletproof providers, resold VPS ranges, CDNs and compromised legitimate third-party servers produce overlaps between wholly unrelated actors all the time. Useful for clustering, close to worthless for identity.

Very weak: the malware family, when it is commodity. Families get sold, leaked, cracked and shared, so "they used family X" tells you about the market, not the operator.

Harder to fake: custom tooling with genuine code overlap — shared non-public source, distinctive implementation choices, a common builder artefact. That represents real development investment. The caveat is that builders and source do leak, and when they do, this evidence degrades sharply.

Hardest to fake: distinctive tradecraft sequences and operational habits. The specific order of discovery commands, a characteristic way of staging data, a particular approach to credential access, timing patterns. These reflect training and process, which are expensive to change, and they sit at the top of the Pyramid of Pain for exactly that reason.

Victimology sits in the middle — a strong corroborator when it fits a known intent, weak on its own because plenty of actors target the same sectors.

The insight that follows is that the artefacts easiest to observe are often the easiest to plant, so an assessment built on what was most readily available is the most fragile kind. Olympic Destroyer is the standard case: the malware deployed against the 2018 Winter Olympics carried planted characteristics resembling a different known actor, and several early public assessments pointed in directions later analysis did not support.

So in practice I weight toward the classes that cost the adversary something, I state which class my judgement rests on, and I hold confidence lower when it rests on one class only — however abundant that class of evidence is.