I am less preoccupied about private companies or government contractors able to carry out cyberattacks on foreign targets and more worried about what constitutes a "foreign target" according to the current US administration.
This is sounding eerily similar to how the setup for a Cyberpunk TTRPG scenario. "Militech hired mercenaries raid Militech facilities wearing Arasaka uniforms to make it look like Arasaka did it?"