This is predicated on the evidence, should it exist, of a Russia-backed security incursion being classified a national security secret. While such a hypothetical claim would have questionable value, would it be worth classifying a bit of information, say, like "the attack ingress point was IP address x.x.x.x, which is owned by Russian military?"
Of course it is classified. And of course no state backed actor is going to use a military owned IP.
And there won't be one single source of evidence which points to it, it will be hundreds of small circumstantial points which taken together point to the conclusion.
Those won't ever be released because they will give away sources and techniques.
By all means, try, but you're trying to use FOIA to uncover literally the exact kinds of information the law excludes from FOIA.