This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, th

This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, the attacker would also need to entirely suppress their own methods and approaches so that they are not identifiable as themselves. Much easier to simply hide who you are by changing your compromise fingerprint than to try to impersonate someone else's compromise fingerprint. If a technique is seen in this attack that has been seen in previous attacks which are now known to be by a russia-sponsored group, that is very strong evidence that the same group is responsible. It is not proof, but it is strong evidence.