Also, would this be the same group that hacked the Socchi Winter Olympics, soon after Russia was banned? The one that the US indicted and labelled as a "petulant child"?
Maybe the attribution isn't 100% (as would be expected with how the attacker masked themselves using techniques from every major nation state hacker) but Russian hackers were indeed indicted for it.
I thought it was a really valuable question! There are several Russian APTs and you made me question my understanding of the attack. I had to reread some stuff to make sure I could answer you properly.