They mostly correlate this by the methods used by APTs.

Each APT usually utilises a specific set of techniques to commit these heists: https://attack.mitre.org/groups/

Obviously perfect correlation is not possible but set of utilised techniques are usually enough to pinpoint the specific APT.