I really wish they would name the 'sophisticated state actor', I don't understand why they don't make that part public. I'm guessing it's either Russia or China, but I still wish they would name the state actor.
We (the business I work for) had ASIO come around, indicate that they should be meeting with top level execs, then claim in that meeting that they are aware that an external sovereign actor has hacked our network and is inside stealing our data etc.
They then refused to answer any questions about how they know this, when it happened, where it happened, how long they've known or anything AT ALL useful or precise or accurate about how we could protect ourselves.
All it did was cause rampant distrust in every direction.
I have a very low opinion of these bastards and deeply suspect them of sewing FUD deliberately in businesses.