How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?
Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive.
> Exactly what does it mean to be "state-sponsored"?
It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf.
> And who provides this analysis?
Government agencies and private companies provide these types of analysis services.