One of the universities is tied to the Chinese military.
So far, this doesn’t tell us anything conclusive. The Chinese government (or another overlord) could be using the universities to make the attack look like a relatively benign student project. Or it could actually be a student project.
In any event, China seems startled that US investigators have gotten this far.
NYT: Within the computer security industry and the Obama administration, analysts differ over how to interpret the finding that the intrusions appear to come from schools instead of Chinese military installations or government agencies. Some analysts have privately circulated a document asserting that the vocational school is being used as camouflage for government operations. But other computer industry executives and former government officials said it was possible that the schools were cover for a “false flag” intelligence operation being run by a third country. Some have also speculated that the hacking could be a giant example of criminal industrial espionage, aimed at stealing intellectual property from American technology firms.