I see what you are saying. Your initial response was dismissive and unclear as to what you were attempting to communicate. Something along the lines of "I disagree with your claim that this threat actor has been identified as Russian" would have been more helpful.

I believe that the industry's identification of APT28 (active since 2007) as a Russian group is based on both the political identities of their targets, and language and timezone indicators leaked in their work. Here is one such analysis from 2014 from a different security company:

https://www.fireeye.com/blog/threat-research/2014/10/apt28-a...