The WellMess malware is an excellent example of how examination of infrastructure and the techniques used in an attack can lead to different conclusions. The malware exfiltrates information regarding the system that it infected, before waiting for further instructions, which potentially include the execution of commands on the infected system and the exfiltration of additional data. We aim to protect customers against threats, raise awareness of current threats, and support the security community. We recognize that we don’t have the depth of visibility of an intelligence or law enforcement agency.”]
Source: https://blog.talosintelligence.com/2020/08/attribution-puzzle.html