Anyone who has worked on cases involving APT from known foreign actors can identify common TTPs and attempt a best guess at the group involved.