You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment

You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy. Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive. > Exactly what does it mean to be "state-sponsored"? It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf. > And who provides this analysis? Government agencies and private companies provide these types of analysis services.