Exactly, it could have been a Russian national, or it could have been someone from the USA, Nigeria or Spain, with enough VPN tunnels and botnets at an attacker's disposal it might take years, if ever, that they could attribute the event back to the true source.