https://www.us-cert.gov/ncas/alerts/TA18-074A
As with virtually every other accusation of "Russian hacking", there is actually nothing presented suggesting that it was Russians that performed these hacks, let alone conclusively proving that. The line of "reasoning" used to accuse Russia of being responsible is, yet again, the same bit of tired tripe. It boils down to, "this attack uses methods that we suspect Russians have used in the past, and we assert that Russians would have liked to do this hack, therefore we have proof that it was Russians".
>Malicious email campaigns dating back to late 2015 were used to gain entry into organizations in the United States, Turkey and Switzerland, and likely other countries, Symantec said at the time, though it did not name Russia as the culprit.
In other words, these were generic fishing attacks that could have been performed by anyone. Since anyone and everyone uses these fishing attacks, we had no idea who it was in 2015. However, now that everyone is blaming everything on Russia, we can safely do so without even casual scrutiny of our claims.