Not necessarily based in china
Anyone who has ever tried to complain about a hack attempt or SPAM from Chinese address space knows very well that there is no point to even try. Any communication goes into the bitbucket and is ignored as a matter of principle. There are providers there which run bulletproof hosting as a service and do not give a damn about what we think.
So if one wants to host the attack platform on a network where the netblock owner is known not cooperate with tracing it to the real origin China is one of the prime choices. That is where RBN went after it was pushed from everywhere else. That is where other ROKSO members went for similar reasons.
So the fact that it has been traced to China so far does not mean anything regarding where the attack has come from. It may have come from a competitor across the street, it may have come from one very well known large petrol and gas exporting country which has a vested interest in knowing its competitor's reserves, it may have come from anywhere.