While attribution is difficult and sometimes impossible, if you find that the attacker used custom malware/infrastructure also seen in other attacks, it is like

While attribution is difficult and sometimes impossible, if you find that the attacker used custom malware/infrastructure also seen in other attacks, it is likely that it's the same attacker group. And in some cases, it's known that certain groups work for certain governments.