This is not compelling evidence - the contractor had the "upload suspicious files" flag on and it uploaded flagged malware - this is consistent with pretty much every AV I've ever heard of and not evidence of a "Russian plot."