A user on Twitter posted a screenshot in which Google warns him as he may be targeted by state sponsored attackers. What kind of attacks can be detected by Google and how?
Google states on their security blog that:
These warnings are rare—fewer than 0.1% of users ever receive them—but they are critically important. The users that receive these warnings are often activists, journalists, and policy-makers taking bold stands around the world.
We can't reveal the tip-off because these attackers will adapt, but this happens to less then 0.1% of all Gmail users.
So I think we can only speculate about how they do it, but you shouldn't forget that google has a lot of information on a lot of people, and enough serverpower to make feasible predictions.