Nothing about this supports a Russian attribution.
You can argue that the report technically wasn't meant as evidence of Russian intervention, but the administration certainly doesn't mind people thinking that it is.
They're using backdoored hardware & TEMPEST, not pitiful phishing scams.