I'm not trying to prop up the Russian military here, but I feel that your statement of "if they could have they would have" doesn't follow to logical conclusion

I'm not trying to prop up the Russian military here, but I feel that your statement of "if they could have they would have" doesn't follow to logical conclusions. Keep in mind, the common attribution of the supply chain attacks across a number of vendors was Russian actors. Also keep in mind that large scale attacks have typically started with thoroughly unconvincing "Hey Bob check this out" emails with a malicious excel doc. The point here isn't to say that the Russian government has mastermind hackers, but instead to understand that an actual and effectual attack doesn't need elite skills, just a few gullible people and known exploits on unpatched servers. I find it far more likely that any world government has the traditional hacks playbook and still get over .500 in most environments they attack without a single novel zero-day. The attack described in the article is to antagonize, no doubt, but I wouldn't be very fast to describe the abilities of someone based on how they troll people. This is not the same as an assertion of "they are the best hackers", it's more I just don't think this is representative of the actual capability of any state actor, the Russian military included.