The main question you probably need to ask is who has the motivation to do such an attack. While in former times it was often enough to brag about the attacks you did and show what a capable hacker you are, cyber attacks are now predominantly seen as crime. This means that bragging about it might even be dangerous and there must be other motivations. Thus the main motivations today are money in the direct form (i.e. ransomware, spam), getting access to important information (espionage) or causing damage against a competing individual, company or country (for example with DOS attacks).
Given that cyber attacks are seen as crime the return of investment should be much higher than the risk of getting prosecuted. If you are a lone individual mounting a larger attack then the risk of being prosecuted is high. If you are instead somehow backed by one state and attack another state then the risk of being prosecuted is usually much lower since you cause damage to competitors in the interest of "your" state. Such state-backing might take several forms: it might be that the attacker is actually employed or otherwise paid by the state for doing such attacks (i.e. state-sponsored) but it might also be a criminal or group of criminals who gets not prosecuted as long as their attacks are only directed at the competing state (state-backed). Or it might be something in between, i.e. criminals getting paid for doing a job for the state.
Many (but not all) of the attacks you see today could actually have been done by motivated individuals or small groups. This includes attacks like NotPetya. But you have to ask what the motivation was. It looks like that in case of NotPetya the main goal was to cause damage and that the main target was Ukraine. So, who might have a large interest in spending resources just to cause damage there? And who might therefore either pay somebody to do such attacks or at least protect the attacker against prosecution? Probably not some lone individuals acting only in their own interest.
Apart from this, some attacks actually require state level resources or at least resources only a larger company has. These are for example access to brilliant cryptographers, power to influence standard bodies or the power to make companies weaken the security of their products (like weakening cryptography or adding backdoors) if they still want to sell to the government etc.
