what indicators point to the malicious code being nation-state and not
organized crime or small hacking groups (Anonymous, LOLSEC, other
In this specific case, the people who know the indicators, aren't telling (yet).
There are a number of indicators that may come into play, such as:
Provenance, or, where stuff comes from -
There has been significant work done to tie together actors and campaigns by analyzing the use of unreleased code. For example:
In 2015 Kaspersky's research findings on the Equation Group noted that
its loader, "Grayfish", had similarities to a previously discovered
loader "Gauss" from another attack series, and separately noted that
the Equation Group used two zero-day attacks later used in Stuxnet;
the researchers concluded that "the similar type of usage of both
exploits together in different computer worms, at around the same
time, indicates that the EQUATION group and the Stuxnet developers are
either the same or working closely together". (Wikipedia)
If the Juniper attack shares certain characteristics with other known APT attacks, then it's likely to be an APT attack. Unfortunately - again - the only people who'd actually know what those characteristics are, at this point, are the incident responders, and they're not talking.
Purpose, or, what can be done with the stuff -
A backdoor on a firewall is brilliant and useful for any attacker. Weakening encryption in a way that can benefit eavesdroppers without requiring endpoint access more strongly benefits APT groups, because they are more likely to have access to ISP-level network captures than, say, Anonymous.
In your comment above you call that "subjective and circumstantial", but it's really not. The described vulnerability has the advantage of being largely undetectable (compared to endpoint compromise, and assuming Detachment 2702 is working properly) and the disadvantage of requiring advantageous network access (which nation-states have been working at since long before there were computers).
Patterns, or, crumbs that don't get cleaned up -
There have been various APT groups whose work was attributed based on strings or commonalities - an email address, a command and control server IP, a source code path name that didn't get stripped from compiled objects. You can bet that whatever got left at Juniper is being gone over with a fine toothed comb, by people who have done the same at dozens or hundreds of other victims. If there are crumbs to be found, they will be found.
It could be any of these, or all, or none. No way to tell until someone writes a paper or releases details which allow us to pin it down.
Update 20151228 - You may want to read "APT28 Under the Scope", which aims to describe a particular APT actor. Notice some of the Patterns they used - they mapped the compile time of the attack tools, to determine which timezone the actors came from. They also found a hardcoded path to a debug file where one of the directories in the path was the Russian word for 'Users'. I'm not suggesting APT28 is the crowd who hit Juniper, it's just interesting to see the analysis process and the level of minutia that can be used to try and attribute responsibility for an attack.