I'll give it a bash, copied from /r/netsec
So here is the deal - you are never likely to see hard proof. The amount of info CrowdStrike was allowed to release is already miles ahead of what almost any other similar forensic investigation is allowed to make public. I've done a number of these for some very large entities, and the most I've ever been allowed to say is "we're investigating a potential incident".
I've had incidents where I was all but positive who was responsible, but the FBI would not allow us to publicly attribute it because there was still a margin of doubt. If the NSA (and many other independent researchers) are willing to say "Yes, this was Russia," you can bet your ass they have a mountain of evidence behind that.
CrowdStrike are some of the very best in the business and were the ones responding to the DNC hack. Here is the evidence they were cleared to provide publicly:
https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
https://www.crowdstrike.com/blog/bear-hunting-tracking-cozybear-backdoors/
(Again, keep in mind there is nothing nefarious about not sharing these details publicly. You will find very few entities that suffered a hack willing to allow responders to make even this much public.)
Additionally there is a good deal of evidence (technical, social, and circumstantial) that Guccifer 2.0 is an identity created by the Russian intelligence services to keep eyes off of them.
https://www.threatconnect.com/blog/guccifer-2-0-dnc-breach/
https://www.threatconnect.com/blog/guccifer-2-all-roads-lead-russia/
Lastly, there is this report from SecureWorks:
https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign
These are three highly respected, independent sources all arriving at the same conclusion. To date I have not been able to find any credible sources that have had access to the details of the cases that have come to any other conclusion. If every independent professional investigating the breaches comes to the same conclusion, you can be pretty certain the evidence is all but overwhelming - whether or not you are authorized to see it yourself.