Potentially unpopular take:

[tychotithonus@infosec.exchange]

Potentially unpopular take:

Attribution is a distraction.

Most orgs are not mature enough for attribution to actually differentiate response (just like honeypots).

Layer 8 is obsessed with attribution -- perhaps to make things more dramatic / urgent? -- so it persists.

So such things get chased, to the detriment of the basics.

https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/545/932/598/911/611/original/ae975377af846d8c.png