Links in tooling, crypto wallets and even attacking victims simultaneously strongly suggest a link, researchers say.