I've never even heard anyone explain how they could prove it in the first place. How do they differentiate an attack launched from Russia with a Russian attack?

I've never even heard anyone explain how they could prove it in the first place. How do they differentiate an attack launched from Russia with a Russian attack? How do the differentiate state vs private actors? How do they rule out intentionally created back doors? It always comes down to "it was the Russians, trust us".