I have seen a couple of corporate hacks (not publicized) who happened to be Russian groups hosted in Syria....
By state 'sponsored' it can mean many things, even if the countries just let them be and some officials get bribed to not do anything.
In this case it was in Syria, which is a fundamental mess, but the fact that it was Russian groups and they have military presence there, it is enough to put it 'state sponsored' label...
..
Edit: This was a purely commercial/blackmail type of thing, so I doubt it was the Russian government/Putin involved directly, but it could just be a side hustle of the same people that do try to hack government targets.
If they have the facilities and the state protection, might as well make some money on the side.