New clues indicate that APT28 may be behind a mysterious intrusion that US officials disclosed last week.