you seem to have misinterpreted what i said, as you seem to think that the point of my message was "russia is behind this" or "russia bad".
.su domain ownership is not geographically restricted. Where a registrar is located tells us nothing about the domain holder.
The only thing I can imagine you misinterpreting would be my comment on "russia's past actions", which I will clarify: I was specifically referring to their history of not cooperating with extraditions or only partially cooperating with international law enforcement efforts. In addition to this, despite being part of interpol, russia's access to interpol channels have been restricted since the start of the invasion into ukraine.
It does not matter who is behind this, they are masked behind anonymity provided by a registrar, which due to its physical location, and the current geopolitical situation, is unlikely to cooperate with international efforts to find the criminal.