After weeks of investigation, the culprits were nabbed. The attacks aren't that bad, the person doing it doesn't want to take credit, or the attacks are coming from overseas. Hackers customarily scan remote computer systems, looking for security holes through which to send or retrieve data. Tools for such scans are readily available for downloading from the Internet. They may or may not be there, but as far as logs on systems will show, unless you are an experienced admin and can tell the difference, you are being attacked.
Most servers have thousands of accounts, and thus thousands of entry points.
He did not differentiate between scans or infiltration attempts. The theory that the recent attacks came from Russia is also questionable. When it comes to the Internet, geography quickly becomes irrelevant. Hacking tools, some of which are readily available online, could allow a would-be hacker to fake his own locale information, or channel his attack through servers all around the world. If you have access to enough servers, it's relatively easy to re-route your connection to make it appear you're in Russia, when you could just be down the street.