First of all, the IC works with estimative language, i.e. "with a high degree of confidence", which everyone understands on what to make of it and how it should inform policy (I know, policy is different than a criminal investigation).
To your question: Imagine tracking these threat actors for years (or decades). You have observed different TTPs (Techniques, Tactics & Procedures) from different actors, you see them operating in different ways and with different teams, you can observe the time when they are active, by their targeting you can make an educated guess what they're after, you can correlate their activity with policy changes in their presumed home-countries and lastly you can repeat those observations over and over again since these threat actors are persistent and keep coming back since it's their job. If all these soft and passive observations already point to the same actor(s), and then you get some additional hard evidence on top (Opsec failures, HUMINT, SIGINT), you are eventually able to make a verdict with a high degree of confidence.