Attribution methodology

One infrastructure broker sells stealth to multiple Chinese espionage crews at once

Black Lotus Labs spent a year mapping a service layer that hands reconnaissance, encrypted relays and routing to several Chinese state operators at the same time. IP-overlap attribution assumes that cannot happen.