they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.).

also google location services might have some data on them too