There's always a person making the decision and moving the funds. The Russian GRU isn't a sentient entity by itself. In principle those people can be held legally accountable, although it practice it's probably impossible.