Just to be fair.... To be FAIR..... The Russians are not teenage noobs putting out scripting bugs, just to see if they can get in the news.
Meaning, the entire purpose of Russian malware is to conceal it's origin.
That is to say, they would design the entire malware package to route information in such a way as to make it exceptionally difficult to find the end point.
Think about it like the Mafia making a phone call (prior to cell phones). The godfather blaw blaw blaw, wouldn't make a call to a hitman from his home phone.
He would call billy, who would come get a note, to take to danny, who uses a payphone to call bill, who goes to the local pub and scratches out a few works on a napkin he hands to bob, who finds someone to do the deed.
Well computer networks are very similarly. You could have it routed to an server in Canada, which bounces it off a university in Kansas, that pings a library in Mexico, that sends it across to Europe and then to Russia.
When you say the "IP address has no relation to Russia", the answer is, well duh. Of course not.
The Russians are not going to create a Malware package, that has the address of the Kremlin right in their hard code, and send it to the US State Department.
Come on... let's not underestimate our opponents.
At the same time, the media has been over anxious to come to a verdict, when no absolute judgement can be made. At least not any time in the near future.
I was thinking about how we could possibly deal with this problem, and the solution was a slap in the face. It's so obvious, and yet it would still be difficult.
All we need to do, is have the computer wizards create a reverse malware kit. It's so simple, the existing malware would do the trick, but slimmed down to only send back location and ownership data.
We don't have to create a system to send the malware either. We don't have to come up with a way to trick the other people.
All you do, is find a system they have infiltrate with their malware. Shut the system down, replace all the super sensitive documents, with our own malware. Turn the system back on. It operates normally, they see the system online, and access it. They steal the documents using their malware.
But when they open it, it's just empty documents, or fabricated documents. That installs our malware, which sends back where the computer is, and any ownership data the operating system has.
No matter how sophisticated their system is, or how many fake IPs they use, or how many different ways they route the traffic, in the end our malware would send back the information about where they are, and what they were doing.
This would ultimately work for every malware in existence, that forwards documents back to an external source.