It _could_ mean any of those things, but in practice most APTs (this one included) seem to fit the profile of “Regular hackers doing this as a full time job”. Most seem to be five to ten people, probably just a small office somewhere. They can be extremely creative but they don’t seem to have extraordinary access to the machinery of state.

And then you’ve got Stuxnet, which both clearly involved many more people than that, but also actual physical espionage.