I think Obama said "no comment" to reporters, but then basically admits it by talking about how he regrets that this information got out into the public.

The best you can do is to make some educated guesses (by looking at the timestamps, coding patterns, comments in the code, who might be interested in hacking the target, political connotation to the attacks etc.). That's usually how state-sponsored attacks get attributed.

For example, "Guccifer" used GTM+3 settings and attacked DNC a few hours after Trump publicly "hoped" that Russians will find the emails. That doesn't confirm that it was sponsored by Russia, but it makes it an educated guess.

https://foreignpolicy.com/2016/10/17/obamas-general-pleads-g...