Often, our intel has hacked their intel and watched them do it.

For example: the US is certain that North Korea was behind the Sony hack because South Korean intelligence hacked North Korean intelligence, and the NSA hacked South Korean intelligence. So the NSA found that it could access Sony servers by going through SK intel to NK intel to Sony.

Another example: one of Cozy and Fancy Bear (don't remember which) is known definitely to be Russian because Dutch intelligence hacked the CCTV cameras outside their Moscow office and was able to correlate times when they conducted spearphishing operations with times when known Russian government hackers were in the office and specific, spearphishing-related Google searches were being issued from computers in the office.

Russian hackers using Google instead of Yandex or other? Or is Google here a metaphor for 'searching the internet'?

I think it was actually Google, but I read the article a while back and it might've been Yandex.

Sloppy opsec is the standard.

1) A classified attribution involving intelligence collection. It could be anything from corrupted foreign officials to hacking

2) A law enforcement investigation would ideally be built upon a collection of circumstantial evidence combined with mistakes by the hacker. In the case of Russia, one of their hackers forgot to log into the VPN before logging into the Guccifer social media account.

Many ways. It’s hard to move $2B while being the target of several rival states intelligence gathering and not leave a trail that leads back to you.

Very. Honestly, they're often not that stealthy (especially N. Korea and Iran) because they have the mantle of an evil regime behind which they can hide. China and Russia barely moreso. Companies with whom I work have been ransomed by these actors, and the FBI has almost always said they know who did it and can do nothing. Policy set higher than them.

Most likely ip address.