I would say the quality of this article is a bit lacking. Offers absolutely nothing new other than speculation from a “widely read” cybersecurity researcher speculating about it being a Russian op.

If the original maintainer can work with LEOs, “jia tan” may have left some clues in the “off list” communications. Maybe headers off original emails show a pattern.

Maybe even coordinate with Google since the attackers used Gmail accounts. Quite possible an attacker accidentally logged in from a non-sanctioned device or sent email from non state owned device.

We are human after all and can make mistakes. Just as the attacker(s) got clumsy towards the end due to patching out loading of unnecessary libraries in systemd