"Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..."

I'm not that knowledgeable about current hacking technologies so maybe this is a dumb question, but how can they 'identify' the origin of these spy-/malwares?

Wouldn't a group with equal or more knowledge be able to obfuscate their origin?

I think it's kind of suspicious that Russian state hackers would send the data to a server that's apparently already known to be owned by Russia.