> when you track it back to a random Russian cybercrime group what can you do with that information?

It shifts the burden from the company to the authorities