Read Vault 7. It’s pretty fascinating and detailed. It’s very specific and instructs the person wanting to lay blame for an intrusion to use languages of the country to be blamed. It instructs them to do the attack when it would be daytime in the other country, Etc. Now conveniently, the treasonous FBI tells us they found the very codes that clearly point to Russia yet again.
My company server logs would frequently show a series of failed remote access attempts during the overnight hours. Most of the attempts came through German IP addresses which I tracked to specific companies in Germany. I complained repeatedly to the companies and to German telecom companies. Never got any satisfaction.
I think a lot of desktop computers turn into zombies when the users log-off and begin running dictionary attacks on any IP address that ‘answers’ (ie. a server).
Could be the real attackers were spoofing the IP addresses or using a remote VPN service. It’s so hard to ‘prove’ where an attack originates.