He has stated a couple of times the attack is coming from Ukraine and gives no further info.
To be precise, what he said was, the attacks came from computers
with Ukrainian IP addresses - which
doesn't prove they were actually in Ukraine, since criminals can mask their originating IP address and substitute another one. Russian cyber-criminals are pros at doing this.
Russia also has a long history of lying and deception, and an incentive to make Ukraine look bad right about now.
I still say Russia did it.