OK, hyperbola aside, stumbling, as in finding the tools still there, and yes, what you said is one of the many possible examples certain people are pushing. Looking at the addresses of all those command and control servers, however, it literally could have been anyone else from any country in the world, regardless of who they were attacking. What are the chances the one with the bad clean-up job is the one found by Russian govt specifically. Esp since they were targeting routers, presumably any response team/curious admin, or one of the million scaning haxors could have either followed the crumbs, or simply stumbled upon the doors left open at the cc end.

Or there's this hypothesis: http://arstechnica.com/security/2016/08/hints-suggest-an-ins...

Which makes a hell of a lot more sense than assuming any of the aforementioned (not least any of the smaller subset of said unlikely scenarios leading to PUTIN).