I'm not sure how you could legitimately come to those conclusions based on on the publicly available information.

There's very little indicating the author is Russian, but considering that's legitimately how most eastern European and Russian hackers type it wouldn't be much of a stretch.

However I can't see how that leads to the conclusion that the author is trying to pretend to be Russian, as opposed to just being from Ukraine, Romania or Russia.

And unless I'm missing something, there's even less information about his OPSEC practices.