They use Yandex for e-mail, so probably a Russian group behind this.