> I'd suggest reading the relevant portions of the muller report and the related indictments of the GRU agents.Why can't you just spell out the method of attribution, instead requiring me to read trough dozens of, mostly political, reports?
> The attack, carried out with many technical signifiers of a Russian state backed attack, that was used to geopolitically help Russia was Russian.
Technical signifiers are not difficult to spoof, nothing about them requires any nation state backing as they rely on heuristics which are semi-public.
That's been the reality of the "cyber theater" for decades: It's asymmetric, there's been more than one example of some lone kid on the spectrum, living in their parents basement, pwning very important and advanced national infrastructure at scale.
That's why I'm very skeptical when a cyber incident is instantly declared as "state level!", usually that's just part of PR and damage control script, along the lines of: "The adversary was a whole nation state, there's nothing we could have done to prevent this from happening!".
Even when the methods deployed are anything but exclusive to nation state actors: Spear-phishing and social engineering are not types of attacks that require nation state resources or knowledge, there's a whole grey market industry offering such attacks as a service.
> The alternative is that someone (who?) was capable enough to infiltrate Russian cyber intelligence resources to then launch an attack on the us, which they then used to geopolitically assist Russia.
Why would that be the only alternative? Your alternative assumes that the attribution to the Russian cyber intelligence is a fact beyond doubt.
> I'm not sure I can think of any attack where someone tried to successfully frame another nation.
That's because if said attack is successful, you wouldn't even know about it being such an attack, that's the crux of the problem.
> Far more likely is that successfully impersonating a state cyber attack is actually really really difficult, because doing so successfully would in general require persistent access to the state actor you're impersonating.
As mentioned before: Nobody needs to impersonate a state cyber attack because by now that's the default assumption not just by media but often enough by those affected themselves to cover up for their own InfoSec negligence.
"We got pwned by the whole Russian intelligence apparatus using massive resources!" sounds much more impressive, and sympathy inducing ,than "We got pwned by some kid from Ukraine because we don't patch our stuff/one of our employees got phished".