A lot of state sponsored activity is outsourced to third parties to create a plausible air gap between the activity and the state in question. The third parties are given a lot of freedom to do things that states couldn't legally do.
And sometimes then get hired by the targets to figure out what happened.
And sometimes then get hired by the targets to figure out what happened.