Tool use, essentially. Of course that could be spoofed, but I think that's the origin of the claim.
https://www.reuters.com/article/us-global-cyber-solarwinds/s...
https://www.reuters.com/article/us-global-cyber-solarwinds/s...
Edit: Your link show Kaspersky labs making the claim that this was the FSB. Yet the West also claims Kaspersky is controlled by FSB! Well, you could say "they should know". Or maybe they want to humor the West so their ban will be lifted. Or maybe they aren't controlled by the FSB at all. But if the West can't figure that out, how do they expect to figure out the true origin of the hack.
"A riddle wrapped in mystery, inside an enigma"