North American University Cyber Security & Malware Attack Discussion

Country1 and Country2 are rivals in oil industry. Country 1 is also rival with Country3 in most other industries. You are a cybersecurity policy maker in Country1. Oil pumps in Country1 have been hit with a malware. They were disabled for 2 days creating economic damage. The first investigations found one line of code that includes comments in the language of Country3. But we can not be entirely sure that the attack was performed by them. List some of the steps we can take as a response to this attack. The steps need to be proportional to the magnitude of the attack.