You are correct that the publicly available evidence doesn't point directly to the GRU, but rather merely to an anonymous extremely well-resourced group whose interests align extremely well with Russian military interests. While the GRU is the most reasonable conclusion, this would leave open, for example, the possibility that some contractor to the Russian military is operating with independence, not actually under direct order from the Kremlin.
The intelligence community claims to have knowledge, through conventional intelligence rather than forensics, that this was done by the GRU themselves, under order from the highest levels of leadership. This presumably means they know who the hackers actually are, whom they report to, and the general structure of the agency. They claim they have multiple, strong, independent sources confirming this, but they can't reveal their intelligence publicly without compromising those sources.
You are correct that the publicly available evidence doesn't point directly to the GRU, but rather merely to an anonymous extremely well-resourced group whose interests align extremely well with Russian military interests. While the GRU is the most reasonable conclusion, this would leave open, for example, the possibility that some contractor to the Russian military is operating with independence, not actually under direct order from the Kremlin.
The intelligence community claims to have knowledge, through conventional intelligence rather than forensics, that this was done by the GRU themselves, under order from the highest levels of leadership. This presumably means they know who the hackers actually are, whom they report to, and the general structure of the agency. They claim they have multiple, strong, independent sources confirming this, but they can't reveal their intelligence publicly without compromising those sources.