Why would it be useful? Doesn't seem like it would change anything about the tactics, techniques, or procedures they're recommending. I suspect that most potentially vulnerable organizations don't care who the intruder is at all, let alone between a nation-state vs. a more heterogeneous country.