Security researchers say it's the Russians, based on evidence they have seen. It's not that people are throwing a dart at a map and picking Russia.
https://www.nytimes.com/2017/05/05/world/europe/france-macro...
https://www.nytimes.com/2017/05/05/world/europe/france-macro...
The 'Fancy Bear' report was also called into question by people looking over the details. They somehow missed that one of the tools used was an outdated copy of P.A.S., for example. More details can be found in past HN coverage.
There aren't a lot of facts to go on here, just a forest of articles citing the same conclusions without bothering to cover any of the details about the underlying technical facts they're supposed to be based on.
This is incredibly superficial reporting, anyone who bothers to look for details will be continually disappointed.
In fact there is a long history of evidence. The Russia defenders love to try to create uncertainty, using these same talking points every time, regardless of the evidence.
The best we ever got on a technical level was that original report from the DNC consultants where most of the IP addresses in the "signature" were Tor exit nodes and they didn't recognize an old, freeware copy of P.A.S. despite it being publicly available.
We've had a lot of utterly laughable things, like the one where someone was intercepting the DNS traffic for a 3rd party marketing site weakly linked to Trump that was making queries to a Russian bank... because of some Russian spam. I can't help but note that the same people keep falling for nonsense of this level.
However, feel free to link to the actual technicals of the reports if you have any. Despite the prior reports being stuff and nonsense (but mostly the latter), I remain open to changing my mind should anyone offer actual proof of some sort. Please note that I'm looking for logs, IP addresses, code and other things that could qualify as actual evidence, not so-and-so's say-so.
The closest this article got to facts were various bits of speculation about people's motives, claiming that Trend Micro thinks it matches this APT (for reasons they didn't bother to cover) and links to past coverage... that also fails to answer any of the obvious questions about what we know and how we know it, for which the usual answer in the past has been variations on interviews with unnamed people, appeals to classified data not in evidence, or random "experts" giving an opinion without disclosing any of the facts used to form that opinion.
In short, it's a lot of hearsay. I follow more or less this process:
https://www.popehat.com/2017/01/19/how-to-read-news-like-a-s...
Most news currently fails this test. I completely ignore all articles that fail the test as unreliable, even when I happen to agree with the conclusions. This applies to other articles as well, not just controversial things.
Maybe there's more to it, but if so they should really put it in their reports.