They mostly correlate this by the methods used by APTs. Each APT usually utilises a specific set of techniques to commit these heists: https://attack.mitre.org

They mostly correlate this by the methods used by APTs. Each APT usually utilises a specific set of techniques to commit these heists: https://attack.mitre.org/groups/ https://attack.mitre.org/groups/ Obviously perfect correlation is not possible but set of utilised techniques are usually enough to pinpoint the specific APT.