Attackers wield Firefox exploit to uncloak anonymous Tor users (ars technica)

Yes, because of the comparably restricted payload and the nature of the websites it is likely it there is some law agency behind it, probably North American. There leaves us with a handful, plus whatever private contractors that offer these services.