E.g. https://blog.sekoia.io/noname05716-ddosia-project-2024-updat...
"The decision not to mandate VPN usage in Russia, especially given their statement “it is extremely unlikely that there will be any problems”, suggests a possible collaboration between the NoName057(16) group and the Russian state."
I imagine you've also heard of attributions like "Cyrillic layout" (used all over eurasia) or "IP pool associated with a Russian AS" (as if VPS renting isn't a thing or commodity routers in Russia aren't hackable and can't be forced into a botnet)
Just blaming public enemy of the day. Knowing who actually did it I difficult and not really important either.
It's also not always Russia, there were two cyber attack headlines yesterday and neither appeared to be state actors.