> you can google for threat actor attribution.

I've had a interesting life. I'm a expert in not getting "attributed" if you will. No need.

> Private companies do this work as well as governments.

It's mostly private snake oil vendors.

Famously the FBI used a conclusion a private company, hired by a presidential campaign made, as a pretext to engage in surveillance on their primary opponents campaign a few elections ago. They did no forensics themselves. They didn't even get the full report and what they got was heavily redacted![0]

[0]https://consortiumnews.com/2019/06/17/fbi-never-saw-crowdstr...