There are a few ways that attackers can make it difficult to distinguish an attack from legitimate traffic:
Using legitimate websites and protocols: Attackers can use legitimate websites and protocols to launch attacks, making it harder to identify the source of the attack.
Hiding their tracks: Attackers can use various techniques to hide their tracks, such as using encrypted communication channels, using multiple layers of servers, or using compromised devices to launch the attack.