They think it's Russia because they waited patiently for the hack and that it's state-run because they used infrastructure not regularly used.

I work in the security industry and I have the ability to do both of these. Does this automatically mean I'm a state-sponsored actor?

We have seen no proof that these latest Solarwinds attacks are from Russia.