Exactly this. I keep reading all of the stuff posted about this and I have yet to see evidence. And in fact, while i'm not a security expert, I am a hosting expert, and I can tell you: That is not how they operate. They obfuscate their origin as much as possible, else it would be trivial to filter them and block them.
I respect Ukraine and Zelenskyy, but I think this claim is untrue.