The article describes a standard phishing attack used by spam bots and Nigerian princes everywhere. And the evidence claimed is that the emails originated from a server belonging to Fancy Bear. It begs the question why they weren't using a VPN or if they were then is this server is actually even theirs.

Even I use a VPN regularly, for things like watching porn or trying to get around paywalls. Don't you think one if the foremost hacking teams on the planet would be very careful to hide their tracks? It's very likely that the server that's been identified is simply a relay hub that someone passed their signal through and that at one point someone claimed it was owned by Fancy Bear.

These claims are akin to saying all Americans must snort cocaine because all US $1.00 bills have traces of coke on them.