Re: "Or do all Russia-based hackers sit in the pocket of Kremlin?"
It's a hacker acting like an advanced persistent threat, and specifically acting consistently with how the the advanced persistent threats thought to be Russian intelligence agencies have acted in the past.
Sure, it is conceivable that another hacker is attempting to spoof the MO of Russian intelligence. But it is hard to see why they would, and would be very difficult to do so in a way that was convincing to, say, US intelligence.
Advanced persistent threat type-hackers are not really trying to hide who they are, because unlike a civilian hacker you cannot arrest them etc., they don't face consequences like that. Advanced persistent threats are only trying to hide what they are doing.
Biting the hand that feeds IT
