For example: the US is certain that North Korea was behind the Sony hack because South Korean intelligence hacked North Korean intelligence, and the NSA hacked South Korean intelligence. So the NSA found that it could access Sony servers by going through SK intel to NK intel to Sony.

Another example: one of Cozy and Fancy Bear (don't remember which) is known definitely to be Russian because Dutch intelligence hacked the CCTV cameras outside their Moscow office and was able to correlate times when they conducted spearphishing operations with times when known Russian government hackers were in the office and specific, spearphishing-related Google searches were being issued from computers in the office.