You should mention that the tank with the crew they have inside is publicly available to anybody in the malware archives of APT28/29. Anybody can plant it. Also

You should mention that the tank with the crew they have inside is publicly available to anybody in the malware archives of APT28/29. Anybody can plant it. Also both the powershell and the py2exe are completely reversible so you can take it, modify it and who's creation is that now? If there is kernel-level stuff then it would be a more solid case but not by much. On top of that, it's entirely possible other completely unrelated attack is responsible for the leaks, but the malware used cleaned up after itself, leaving only the less sophisticated trail behind. Clearly if 2 groups hacked them in the easiest way possible, it's in fact suspicious why haven't they been hacked by other groups. It's almost a certainty others came after it.