It's much more likely that these guys were either using a Russian VPN, or one or more of their devices were compromised.
It's much more likely that these guys were either using a Russian VPN, or one or more of their devices were compromised.