Specific groups of hackers often have various markers that appear throughout their various malware.

Reused code fragments are the most obvious one. Others are specific code styles such as variable naming, even formatting. It’s basically the same stuff that is used to determine whether a specific text was most likely written by a specific person.