Mullvad

I'm almost certain US law enforcement, at least until recently, would've directly operated such a service.

In the same way that it's relatively easy to find a hitman on the dark web, it's considerably harder for them to actually not be law enforcement.

Which is fine for the attacker here. All they need is to hit the login endpoint from an IP that's geolocated to the US. They don't mind if it's possible to trace it to their Russian IP. And that's roughly all that the VPN service sees. I explicitly mentioned Monero because I believe that when used properly, it wouldn't add any extra information.