Read the whitepaper that CrowdStrike wrote on the HammerToss virus. They attribute it to Russia for two reasons:
1) It is "sophisticated", because it uses public services like Twitter/Github and embeds command & control scripts into images. Any mid-level application developer could write a similar virus in a weekend.
2) The work required to keep the virus operating (registering Github/Twitter accounts, posting messages) was done during the Russian workday. Because the Russian hackers are highly sophisticated enough to write this virus but incompetent enough to not cover their tracks.
This is the clearest, most blatant example of the US propaganda machine at work. With no concrete evidence whatsoever they have accused a nuclear power of performing these attacks, and the media and a bunch of "infosec researchers" (who most in tech recognize as charlatans) fell in line.