Identifying who’s responsible for a cyberattack is a tricky business, mired in uncertainty and couched in gradations of likelihood. Even once the technical work is complete, governments often hold back from formally pinning the blame for political, diplomatic or intelligence reasons.

“It is not known who is behind this attack, and it may never be possible to identify them,” a spokesperson for Belgium’s cybersecurity agency said.

Walks like a duck, hacks like a duck

Still, in the wake of the attacks, many analysts had one culprit in mind: Moscow.

Along with Iran, China and North Korea, Russia is considered one of four countries that have most commonly targeted Europe with state-backed cyberattacks. But experts say the patterns and targets in this case exclude the other three.

“We strongly believe this activity could be attributed to a Russian state-sponsored threat actor,” said Xavier Bellekens, CEO of cybersecurity firm Lupovis.

He said that his company’s researchers have collected data on attacks against decoys — known in the industry as honeypots — that point towards a “state-sponsored group.” The expertise required, such as an understanding of industrial control systems and refrigeration technology, is “not trivial,” Bellekens said.