Mandiant said it was able to cement the connection between APT1 and the Chinese because the attackers were forced by censorship measures in China to log into social media accounts such as Facebook and Twitter directly from their attack infrastructure.