The only thing I've seen that even possibly makes sense is that it was the officer's home/personal IP, not work. Which might also explain the opsec slip up, but

The only thing I've seen that even possibly makes sense is that it was the officer's home/personal IP, not work. Which might also explain the opsec slip up, but until I see something more credible than an anonymous source (which may happen soon from muller) or a better explanation, that statement is ringing some alarm bells for me. However, the article doesn't explicitly state GRU headquarters, just ties the officer to GRU headquarters and tries to imply the connection was directly from their HQ w/ weasel wording.