I named three in my first comment above. There are also Mandiant (FireEye) and SecureWorks. Previous attacks with the same malware were attributed to Russia by Threatconnect and Microsoft, who calls the "Fancy Bear" group "Strontium."