It sounded like they're making the assumption based on the type of malware used: > “Ryuk” attacks are “highly targeted, well-resourced and > planned,” acc

It sounded like they're making the assumption based on the type of malware used: > “Ryuk” attacks are “highly targeted, well-resourced and > planned,” according to an August advisory by the U.S. > Department of Health and Human Services’ cybersecurity > program. Victims are deliberately targeted and “only > crucial assets and resources are infected in each targeted > network.” "well-resourced" I imagine shifts the probability towards the "state sponsored" direction, and they probably know more than they're sharing in the article. I do agree that the headline seems inappropriately assertive of the attack being of foreign origin.