Motherboard was able to make contact with the purported attackers.
This doesn't carry any of the typical fingerprints of a state-level attack. It was a single exploit against Cisco devices, combined with Shodan for an easy directory of vulnerable devices.
Given the recent surge in nationalistic sentiment among young people in the tech community in the last decade, it looks reasonable to stick with the simplest explanation here: one or more folks found a flaw and exploited it for fun and attached a flag to it for more fun.
There are situations for which "Russia did it" is an explanation that makes sense. I don't think this is one of them.
We should also beware of being too willing to jump to conclusions that anything was done by America's enemy-du-jour; the country's been down that road plenty of times before and it never goes anywhere good.