This question already has an answer here:
My question is:
How can we make any conclusions about malware authors at all, when anyone could just get sample malware online, copy paste the parts they like, and add their own parts to it?
Obviously there are many types of malware this question would apply too, but I'll use WannaCry as an example. Suspicion was based on a lot of techniques and logic parts used in the malicious files because some were identical to malware used by North Korean groups before.
But during this video the reporter even says that this could be a ruse by some other nation state actor. Seems like any assumption regarding malware authors is just made for political reasons, seeing as no one can guarantee that this one particular makeup of binary data is related at all to one particular group.
I'm wondering if a few lines of matching assembly (see video) is justification enough to release headlines like this, getting the general public on the fence about Cyber War One, when it could have literally been a 20 something year old that had access to any possible spam folder?
I am aware that sometimes certain artifacts in the code can help figure out who might have written it, but in the video it looks like they are connecting a government to a world wide cyber attack based on assembly instructions. This seems different than accidentally leaving the authors address in the whois info, or forgetting to delete the hard coded credentials.