Attribution is hard. However, you can see some specific snippets of code (in assembly) here and there that tells you that, possibly, the code was written by the same team. I, as for myself, consider graph matching a very trusted approach to determine if a malware is created by the same team and is what I typically use for this purpose.
Basically, graph matching works like this: if, once the files are completely unpacked, 2 or more binaries have a very similar call graph and very similar control flow graphs with only a few functions differing or only some basic blocks in one specific function or just some instructions in, say, one basic block somewhere, the files are likely created by the same team or author and is, likely, a new version of the same piece of software. Unless we're talking about virtual machines created with tools like Themida or VMProtect, this is commonly true.
This was the idea inspiring the (not public any more) product VxClass created by Zynamics or the CAMAL clustering engine I wrote myself (examples here and here). If you prefer to read an Open Source approach for doing exactly this, I recommend you to take a look to GCluster. This is a command line based tool using the Pyew API for clustering 2 or various unpacked malware files (PE and ELF executables) to determine how similar are them.
You can also use, as pointed out by @Mick, Yara signatures or fuzzy hashes based on the binary contents (bytes). However, they're likely going to create a big number of false positives (you're considering the bytes and finding for byte-streams, not comparing the structure of the executables as graph matching does).