It's quite obvious to many that it was the Russians, even in the absence of formal proof. Why do we have to keep seeing this assertion, especially when the CIA had a team making malware that emulated or included ostensibly Russian code. No one was trying to frame the Russians; it was just to save time.
https://theintercept.com/2017/03/08/wikileaks-files-show-the...
Dell SecureWorks and the CIA have presented plenty of evidence that this was a Russian-backed group, probably GRU.
EDIT: Also, even if there aren't lines in their malware which say "(c) GRU 2017", Fancy Bear is a group which consistently targets enemies of the Russian government. They don't steal credit card numbers, they commit digital terrorism that furthers Russia's interests. It doesn't really matter if they're 100% state-backed or not, because they clearly and consistently act in the Russian government's interests. An organization which hacks targets that benefit Russia and a Russian gov't hacking organization are the same thing from the perspective of the United States.
http://www.bbc.co.uk/newsbeat/article/37374053/what-we-know-...
Russian - would make a lot of sense. Run by the government? Seems more like the sort of approach I'd expect from a bunch of kids who got bored of spamming/malware and got political. Phishing isn't really an advanced technique by intelligence agency standards.
There is considerably more than zero evidence that it was the Russians, though most of the public evidence is indirect.