Attribution is tricky, but nation-state actors have resources that no other threat type (organized crime, hacktivists, etc.) can muster: multiple 0-days, advanced tools, obviously deep field of programming talent, inside info about targeted networks/apps, etc.

Not to mention, that forensic analysis of tactics, tools, etc. often clearly point to borrowing/surveiling of other APTs.