Above answers Q's question of who was in London, I do believe, and when.
>What if intel masked penetration(s) to frame Russia?
Vault8:
>The three examples included in the source code build a fake certificate for the anti-virus company Kaspersky Laboratory, Moscow pretending to be signed by Thawte Premium Server CA, Cape Town.
https://wikileaks.org/vault8/#Hive
>One of the persistence mechanisms used by the CIA here is 'Stolen Goods' - whose "components were taken from malware known as Carberp, a suspected Russian organized crime rootkit." confirming the recycling of malware found on the Internet by the CIA
https://wikileaks.org/vault7/#Grasshopper
>The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion
https://wikileaks.org/vault7/#Marble%20Framework
There's others, of course, but false attribution of attacks is as old as history, to genuinely think anyone would not falsely attribute an attack is to ignore history itself.