Knowing that a thing is true is categorically different from knowing how to do something— Knowing that group A uses technique B doesn’t automatically make you proficient at using B yourself.
Masquerading as a particular cyber-attack group requires not only knowing what techniques and tools they tend to use, but also how to do those things yourself, while imitating their style. It’s not impossible, but neither is it trivial: We’re not talking about simply first impressions here, but fooling a concerted, post-hoc investigation.
