We have fairly extensive evidence that Sony was hacked by a Russian-based APT group. It is likely they were paid to do so by the North Koreans. Check out https://www.operationblockbuster.com/wp-content/uploads/2016... for more info. TL;DR attribution is based on shared C2 and staging server infrastructure, a shared code base with unique implementations, and even shared public keys.

Disclaimer: I know and have worked with the people on Operation Blockbuster.