they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social n

they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.). also google location services might have some data on them too