Microsoft claims [2], "We believe this is nation-state activity at significant scale ... Because of the sophistication of the techniques and operational security capabilities of the actor, we want to encourage greater scrutiny by the broader community..."
[1] https://en.wikipedia.org/wiki/Cozy_Bear
[2] https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...
The Washington Post claimed it was specifically APT29/CozyBear, also based on "3 anonymous sources familiar with the hack" with no supporting information.
Neither FireEye nor the US government have officially attributed the attack to any state actor, nonetheless russia, though it would be unusual to make an attribution this quickly anyways.
FireEye makes no note of any tools used in the hack that have been previously associated with either APT29 or Russia in general. Their countermeasures [0] seem to suggest all injected code was either in english or encrypted, but it would be pretty dumb to leave unencrypted russian (or any other language) text in your hack of a US program.
The security group Intel 471 apparently [1] found a russian-language actor trying to sell access to the solarwind network in April 2020, but it is unclear if they actually had that access, if that access was connected with this hack, or if this individual was anything more than a middleman. I just googled the name, and there is a facebook page for someone with no friends or activity who is signed up for a couple of ukrainian groups (a support group for the mayor of a town, a public transit department, etc) so the facebook page is clearly a bot but there may be no association.
That's the closest thing I could find to evidence.
[0] https://github.com/fireeye/sunburst_countermeasures [1] https://twitter.com/Intel471Inc/status/1339233255741120513