This is nonsense. Incidence response teams base their conclusions on whatever forensic data they collect. There are generally consistent patterns of behaviors

This is nonsense. Incidence response teams base their conclusions on whatever forensic data they collect. There are generally consistent patterns of behaviors with state actors and often investigators are even able to identify the different offensive cyber units of nation responsible. While the group of IPs involved would weigh into this calculus, it was likely not nearly as significant as you might be suggesting. What is the point of this conjecture and why suggest there is a reason to doubt their conclusions?