Usually, a big part of attribution is the reuse of specific TTPs (tactics/tools/procedures), malware components, and components of C&C infrastructure - sophisticated attacks are tool-heavy, the tools are custom and generally not distributed much (even within the same country - e.g. it appears that in Russia the military intelligence and foreign intelligence units don't share much of their tooling/infrastructure with each other for some political reasons), you don't/can't recreate all that code from scratch for every single attack, so there's inevitably reuse that allows you to link some attacks to others. Since there are some earlier attacks where we can link particular actions not only to a country, but to specific people in specific organizations, usually due to some mistake on their behalf, it's sometimes possible to also determine the attribution of new atacks with reasonable certainty.