[throwaway290]

> 1) How do you tell a state actor from just hackers looking to make money?

Why do you think those governments are not just trying to make money? You should check how much crypto DPRK made from ransomware. Krebs and others wrote about it

[ClumsyPilot]

Well yes, the real distinction is - is that someone trying to make money, and it’s ‘nothing personal’ or is it political

[throwaway290]

Either way a crook who wants easy money, no real distinction.

But it doesn't mean you can't trace what exact crook did by correlating various signs. Plus, nation state crooks have more capability usually.