You need to look at things like the complexity of the malware, how many staff it would take to develop and maintain it operationally, the targets selected and what sort of payloads are executed. Criminals tend to have simpler malware that used known exploits or a small number of zero days. They generally cast a wide net for their targets and their payloads typically aim to directly raise funds(ransom, mining, card theft, etc).

In contrast, nation-states tend to have complex malware with multiple zero days, greater care is taken to avoid detection, their targets are chosen carefully and their payloads focus on gathering information and specialized operations.