According to court documents, the IRA took several measures to hide its tracks, duping the technology companies who were unaware, or unable, to stop what was filtering through their systems.
The key - and obvious - move was to hide the fact that these posts were coming from Russia. For that, the IRA is said to have used several Virtual Private Networks - VPNs - to route their operations through computers in the US. The operatives allegedly used stolen identities to set up PayPal accounts using real American names.
In all honesty, I would expect at least an organized troll farm to use VPNs ending outside Russia.
Random people in Russia might just act directly, but it’s a red flag that’s easy to pretty-inexpensively eliminate.
googles
It sounds like at least the Internet Research Agency troll farm used VPNs.
https://www.bbc.com/news/technology-43093390
Even if it’s just a hash of an ip4, that would go a long way towards identifying who is coming from where