That's an excellent question. There are some pretty clear distinctions in terms of how the threat is assessed. Part of it is related to the goals that are being achieved by the threat actor.
Bo is one of our specialists in this area. I'll ask him to explain it in more detail.