Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted.
Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z"
If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization.
You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.