There isn't a clear dividing line. What you have are criminal organisations who may get protection and shelter from governments in exchange for making attacks which are incidentally beneficial to that government.
The skillset to compromise large enterprise networks is more readily available and more profitable than the skillset to compromise SCADA systems, and for all the flak they get, the culture at most large engineering firms in the West is extremely safety conscious. If it's not provably operating safely, it isn't. So it gets shut down.
So you all need to do is deny the link between the actual control system and lines of engineering reporting.
(imho it depends on how sophisticated the attack... given the typical lameness of SCADA defenses, one can't assume...)