Just as a follow-up, I eventually found the Trend Micro report linked from an Ars Technica article. It's justification for labeling this as Fancy Bear was that

Just as a follow-up, I eventually found the Trend Micro report linked from an Ars Technica article. It's justification for labeling this as Fancy Bear was that they saw an email address from a free provider that they believe is linked and some cyrillic text. That's not really very much, given that the original label for this APT is already quite tenuous, given how the 'signature' from the original report consists of things like using Tor exit nodes that are quite common. Maybe there's more to it, but if so they should really put it in their reports.