[kube-system]

It’s not easy.

> Unlike traditional cybercriminals, state-sponsored attackers apply exceptional resources to target a very small number of specific individuals and their devices, which makes these attacks much harder to detect and prevent.

> State-sponsored attackers are very well-funded and sophisticated, and their attacks evolve over time. Detecting such attacks relies on threat intelligence signals that are often imperfect and incomplete. It’s possible that some Apple threat notifications may be false alarms, or that some attacks are not detected.

Identifying the source of these attacks is often done by analyzing the tools and techniques, in comparison to other known tools and methods, and/or by information gathered in meat space.

[bsd44]

I was being sarcastic. Not only is it not easy, it is impossible! There is no such thing as distinguishing a cyber attack of any kind between a state-sponsored and independent-sponsored. This move by Apple is bizarre to say the least.