The question about about TOR? Sure, they could have used TOR, but that doesn't make them automatically untraceable. I am definitely not an expert on this kind of forensics, but in past cases the "smoking gun" pointed to by experts tends to be some sort of metadata (i.e., text files encoded using cyrillic character set), not an ip.

Also, there's been some claims that NSA and other agencies are running TOR exit nodes. Not sure if there's anything to it, but the point is state level actors have resources that nobody else does.

Besides, I am not sure what is your point. "Russian hackers would have covered their tracks, therefore it must not have been Russian hackers"?