https://arstechnica.com/security/2016/12/the-public-evidence...
There is some evidence, but no definitive evidence.
'"[SecureWorks] researchers assess with moderate confidence that the group is operating from the Russian Federation and is gathering intelligence on behalf of the Russian government," the report from SecureWorks concluded.'