@simontsui Kaspersky has said a while back they will stop doing attribution—most likely because they'd just have to attribute most groups to RU allies like Iran, DPRK, and China and they don't wanna rock the political boat.
They know exactly who this is