During a breach investigation, an analyst has confirmed the malware family, the exploited vulnerability, and the affected systems. Management now asks the analyst to determine WHO conducted the attack by correlating TTPs, infrastructure reuse, and language artifacts in the code with a known threat group. Which investigative concept does this task represent?