One of the FireEye researchers, Andrew Thompson, tweeted multiple hypotheses the FireEye team considered in attributing the activity. One theory held that an unidentified threat actor emulated APT29 in an attack Thompson said was "technically feasible."