There are any number of bad actors behind cyber attacks these days. Ransomware attacks are a good example of where historical and contextual information is key. The wrong indicators of compromise (IOCs) are collected, it can lead to false information and an erroneous attribution that actually does more harm than good. Don’t let attribution sidetrack you. Defenders can look for specific elements gathered from previous, correctly-attributed attacks to observe and identify them in order to mitigate an attack before it occurs.”]
Source: https://www.csoonline.com/article/3619790/don-t-make-haste-the-downside-of-rushing-attribution.html