[_heimdall]

The article mentioned that traces of a few GitHub repos were found. One of the READMEs left behind described a tool used to create a multihop network to hide the original source.

Seems plausible that they could have used that tool when logging in and it happened to bounce off a Russian IP.

[catlikesshrimp]

Maybe they successfully identified and blocked all the attacks from Russian IPs, but not the case of other attacks