From the site you linked, the one with "unknown" motive has exclusively attacked Chinese academic victims. It would be extremely bizarre to suggest that the Chinese government is behind this.

The second one is the attack that spread all the way to a basement HPC cluster in the Physics Institute at LMU Munich, the IP addresses listed are indicators to look for that your system might be compromised, not the victims of the attack.

It's worth pointing out that countries regularly hack and attack their own citizens. In some ways, it's more important to know what they're doing than what your opponents' are.

Ah, I misread the table. This is very suggestive, then.