@ridt - on deceptive ops and potential for misattribution: CIA ‘UMBRAGE’ database of hacking techniques from other groups is an interesting case study too. Although the code reuse here was supposedly done to save time - as reported by @kimzetter in 2017 https://theintercept.com/2017/03/08/wikileaks-files-show-the-cia-repurposing-foreign-hacking-code-to-save-time-not-to-frame-russia/