Or are they....
Russian ISP's have a certain reputation for hosting all sorts of no-questions-asked-as-long-as-the-bills-paid software.
So yes it could be they are just so blatant they don't give a f**k who knows where they come from.
Or maybe they are from somewhere else?
Attribution is tricky. Although it always seems to be more so when it comes from the people on the "official friends" list (Stuxnet anyone?)