How does Google differentiate a malicious offensive security operation from a benign one? Previous websites and social media accounts posted malicious content,

How does Google differentiate a malicious offensive security operation from a benign one? Previous websites and social media accounts posted malicious content, but this Google blog post doesn't really do much to connect the between the previous accounts and the new ones.