> It said the hackers launched their campaign from three computers on the mainland. In theory, those machines could have been compromised by someone elsewhere.

In theory? This type of reporting is concerning. Surely these reporters (as well as Symantec) ought to know that these type of attacks in theory could leave a true IP trail, but probably not.

There might be other signs that this is a Chinese operation, but IP addresses is not good proof.