Usually I trust Kaspersky to ID the correct Advanced Persistent Threat when it's Western and FireEye when it's non-Western, in this case APT28 a.k.a Fancy Bear.

Usually I trust Kaspersky to ID the correct Advanced Persistent Threat when it's Western and FireEye when it's non-Western, in this case APT28 a.k.a Fancy Bear. APT28 is pretty obviously Russia, due to character encodings in the files, timestamps, etc. etc. etc. If I'm not mistaken, the attacks almost always also leak the location of a particular Russian government building. The technical evidence for their previous attacks is so extensive it seems they want to be caught. They're who the Russian government sends when they want to make it obvious it was them to other governments, but don't want to start an open conflict.