is often difficult to prove in cyberattacks, such as when a phishing attack targeting White House staffers and military officials $($believed to be linked to the Chinese government$)$ results in stolen login credentials and months of unauthorized access to emails.$$