I imagine the attribution factors were something along "we saw IPs associated with Russian ISPs and cloud providers" or "parts of their infra were accessible from Russia without using VPN".