Which is the more likely of the two?
1. The hacker actually worked for GRU, which was already known to engage in such activities, and slipped up once?
2. Somebody hacked into a GRU office so they could connect from there one time and hope somebody would notice?