It can be very hard to determine who is really doing the attacks. For example, we know that North Korea is surprisingly active in this area[0]. Even though they are probably using servers in China, the only nation that they still have somewhat friendly relations with, it is better for them if the attacks appear to be coming from Russia.
[0] https://www.wired.com/story/how-north-korea-robs-banks-aroun...