Competitor is not an "threat actor". Based on the information provided, it seems that the most likely threat actor involved is an APT/nation-state. This is based on the fact that the security analyst's investigative report describes lateral movement across the network from various IP addresses originating from a foreign adversary country, which typically indicates a more advanced and sophisticated type of threat actor.
A competitor is also a possibility, but given the other indicators (website defacement, calls from the company president about the damage to the brand) and the fact that the security analyst's report specifically mentions a foreign adversary country, it seems more likely that an APT/nation- state is the primary threat actor in this scenario.