What country? Article does not say.
Some sophisticated stuff goes into not just crafting function, but what something looks like
I am always sceptical... no, quite cynical, when a few days or hours after an incident someone pops up and says "It was the <Russians/Koreans/Chinese>"
Perhaps one of the most potent payloads in some hacks, perhaps even the overarching motive, is to pin the action on someone or something.
It raises the question, how much that really matters.