So far as I understand it, "hacker groups," private or state-level, are generally identified by the tools they use. The same groups will re-use the tools and exploits they have over and over, including some known libraries. Security researchers capture the malware sent out from those groups and reverse engineer them. These allow groups of malware signatures to be created, which allows researchers to start to identify potential actors. It didn't take long for the security community to start blaming certain organizations for Stuxnet, despite there being little proof of their claims...