The NSA warning specifies the Russian GRU as the culprit, acting under the name Sandworm. There’s likely quite the story behind how the current attacks were discovered to be of Russian origin.