"The organization, known as DarkSide, is a relatively new hacking group that Western security researchers say is likely based in eastern Europe, possibly in Russia. The organization created the malicious computer code that resulted in the shutdown, officials said."
-WallStreetJournal

Good call on the Russia angle