Earlier quoted context omitted.
The "evidence" boils down to: The Hackers drove a truck. Russians drive trucks. The Russians did the hacking. While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
It is more like: 1. Hackers drove a custom built tank that has Moscow factory markings. 2. Similar versions of the tank were used in other campaigns attributed to Russian intelligence. 3. Crew in the tank has been associated with Russian intelligence operations going back ten years. 4. The tank left from a building known to be associated with Russian intelligence hacking campaign. Thus, the hackers probably take orde…
You should mention that the tank with the crew they have inside is publicly available to anybody in the malware archives of APT28/29. Anybody can plant it. Also both the powershell and the py2exe are completely reversible so you can take it, modify it and who's creation is that now? If there is kernel-level stuff then it would be a more solid case but not by much. On top of that, it's entirely possible other completely unrelated attack is responsible for the leaks, but the malware used cleaned up after itself, leaving only the less sophisticated trail behind. Clearly if 2 groups hacked them in the easiest way possible, it's in fact suspicious why haven't they been hacked by other groups. It's almost a certainty others came after it.