Director of National Intelligence James Clapper said the investigation into the massive attack Friday that pounded the underpinnings of the internet was still underway.
"There's a lot of data to be gathered here," Clapper said in an interview with CBS television host Charlie Rose at the Council on Foreign Relations in New York.
Asked if the internet attack was done by a non-state actor, Clapper said: "That appears to be preliminarily the case."
Rose asked a second time whether it was a non-state actor.
"Yes, but I wouldn't want to be conclusively definitive about that yet," Clapper said. "That's an early call."
"We've had this disparity or contrast between the capability of the most sophisticated cyber actors, nation-state cyber actors, which are clearly Russia and China, but have to this point perhaps more benign intent," he said.
"And then you have other countries who have a more nefarious intent. And then even more nefarious are non-nation-state actors," he added.
Several waves of attacks deprived millions of people of access to major websites such as Amazon, eBay, Twitter and Spotify, and alarmed authorities.
The list of victims also included Reddit, Airbnb, Netflix and the sites of several media, among them CNN, The New York Times, The Boston Globe, the Financial Times and the Guardian.
The attack on domain name services company Dynamic Network Services Inc in turn took down the sites.
The company, known as Dyn, said it was struck by a series of so-called distributed denial of service attacks in which adversaries flood servers with so much traffic they stumble or collapse under the burden.
On Monday, Homeland Security Secretary Jeh Johnson said the attack is now believed to have been "mitigated."