The international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usua

The international market exists, but there is no evidence of the malware having any positions there or any efforts to promote it there, which is how things usually are. So, it is used mostly by Russians and Ukrainians and is known almost only among them. If you believe the intelligence agencies, it's only logical to believe that Russians did in fact do it. Simple estimates based on the things that we know about the world don't suggest other possibilities. Not that it matters though. Russia already did a lot worse, but US officials were so afraid to call it out, even downing MH17 was presented as if Russia "helped rebels" and didn't do it itself.