When investigating breaches and trying to attribute them to specific threat actors, what is NOT one of the indicators of an APT?

Although you might suppose that a nation-state attacker (the usual attacker behind an advanced persistent threat) would attack from a foreign IP address, they often use a compromised address in the target country as a base for attacks. Other options are all incorrect. These are actually signs of an advanced persistent threat.