I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.
There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false.
As a overly generic rule, trust (or don't) the Institution over the individuals.
Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"?
To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.
So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially.
Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.
That is precisely the same line of reasoning that started the Iraq War based on lies. The New York Times claimed to have intel from anonymous sources showing that Saddam Hussein had nuclear weapons, and their false reporting is what led the US to declare war. That snafu didn't happen all that long ago, and yet most people in 2020 seem to have blocked it out of their minds.
But Russia actually does have a strong black hat culture, with links to the political establishment. Putin is a technologically savvy kind of despot who likes sneaky low-cost high-return actions. So this fits the profile - both as a workable hack and also as a proof of concept for future attacks.
Consider the cost/benefit. Instead of physically blowing up infrastructure and security systems you can cripple them, possibly permanently, for the cost of - what? - 20 or 30 specialists, some PCs, and maybe some supercomputer time. Although even that may be optional.
It's unlikely conclusive evidence will be released, because that might reveal too much information about defence strategies. So circumstantial evidence will be as good as it gets.
But whatever the cause, clearly - clearly - all countries and larger orgs need to work much harder on security. Some decorative pen-testing isn't going to be nearly enough in the 2020s.
At some point you have to trust others to be good at their jobs, and when an org like WaPo demonstrates their proficiency over and over again, their believability rises.
The Washington Post's record on verifying the claims of the US national security apparatus is poor. The newspaper uncritically reported false claims by the Bush administration about Iraqi WMD. Many people people at the time found those claims extremely dubious, but critical voices were belittled or shut out of most mainstream reporting. More recently, the Washington Post has been all-in on Russia paranoia. That doesn't mean that everything they publish about Russian hackers is wrong, but it very well may be misinformation leaked by US intelligence officials, or something insignificant blown out of proportion and presented without any context. In December 2016, for example, the Washington Post reported that the Russians had hacked a Vermont utility. That story turned out to be complete nonsense, but the Washington Post never fully retracted it. If you look at the story today, you'll still get the impression that the Russians attempted to hack the utility, even though that aspect of the story completely fell apart. The Washington Post on Russia is a bit like Bloomberg on Chinese hackers (e.g., Supermicro).
bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market
Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...
Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.