control infrastructure, are just some of the components that go into determining attribution. Knowing the methods and behaviour of the attackers as well as the character of the tools the attackers use once inside the target