“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.”
How do they know it was a Chinese group or even a state sponsored one?
I didn't say that to be pedantic, but to avoid that particular type of asker who isn't actually asking a genuine question here. After listing all the ways that Notepad++ (as an example here) suspects who they suspect, the asker then comes back with "Yeah, but how do you know?", as if that's some sort of gotcha. It's disingenuous. Even if the person I replied to isn't attempting this, I find it good to call out and get people to ask a better question: what's the evidence and why does that evidence point to this conclusion?
With enough effort, anything can be obfuscated. But effort costs money and also state level actors have limited funds and time and want to go home to their families ar some point and if the purpose was to get a message across (don't mess with china, otherwise face the consequences) there is no need to really hide the origin.
