This is the next generation of warfare, attribution is simply impossible. Even if there existed actual forensic evidence it could not be relied upon.
Reacting to purported attacks at face value will leave you like a 1-layer chess player, potentially acting on behalf of your adversary.
That one is more likely to be used by the Chinese: https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-...
The Chinese implementation of the XTunnel protocol is in Java (the GitHub project is written in Java, and you can see an embedded JRE in your blog post's link to the Chinese tool in the strings here: https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18...). The FancyBear implementation is not (no embedded JRE here: https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126b...).
If you want to see how professionals do it, take a look at https://www.eset.com/int/about/newsroom/research/dissection-....
If it turned out that Russia was not behind these attacks, the scale of the bad publicity for Crowdstrike, Fidelis, Palo Alto Networks, etc. would nearly put them out of business. Unlike you, they have skin in the game and don't make these claims lightly.