It's worth noticing that while they didn't target specific people or made the attack undetectable through cache control trickery, the tools they are looking for can be used to detect such evidence removal.

So they are probably building a Government database of IP/people using such tools!

This target mainly Russians, but you know, as Mozilla use to say... "this is the Web functioning as designed"!