You have clearly read at least part of the article since you started this thread by claiming phishing is not hacking. The article also states that the group Proofpoint was tracking was at the very least Russia aligned. The scripts they were using were customized to target NATO and NATO aligned organizations. We know they were targeting pro NATO and pro Ukraine officials because they have attacked multiple countries, and all their targets fit that bill. This is in the first two paragraphs of the article.