There are different ways to unpack this question.
First, are we talking about state-intent cyberattacks, criminal-intent (stealing) cyberattack or a mixture of the 2?
Second, the very nature of cyberattacks gives them plausible deniability. Which also leads, by reverse, to plausible accreditation: "Russia did it, because we say so". So any list published by any government or government-affiliated organization is possibly tainted by intent to smear.
Third, a state may suffer cyberattacks and emit cyberattacks. Especially in the criminal intent sphere, there is huge value in leveraging cyberattacks' capabilities to work across the globe to attack somewhere outside of your own judicial sphere and rely on haphazard extradition procedures between unfriendly countries to limit your risks. Lauri Love, for example, shat in the wrong nest when he, as a UK citizen, hacked into US computers and barely avoided extradition.
So, yes, all, other things being equal, I would expect USA cyberattack incidents to emanate out of Russia/China. While Russian victims of cybercrimes might correctly suspect US or Ukrainian hackers. So the story changes depending on the viewpoint of the victim.
Fourth, while it is difficult to pinpoint attribution of one specific attack to a given country, let's look at specific cases:
Stuxnet. Iran's centrifuges being the target, both the US and Israel have long been suspected. It would be naive to therefore claim that the US never does any such things. Remains to be seen how often it does this kind of stuff, which is what this question is about. There is a rumor about a Siberian pipeline hack, I think.
Ukraine has, by pure coincidence, been the repeat target of pretty drastic cyberattacks, ever since its relations with Russia soured in 2014. NotPetya and power plants.
Most damningly, you have to look at the Estonian cyberwar of 2007 where, shortly after Russia felt "disrespected" massive denial of service attacks disabled much of government IT and services. Just like Stuxnet, you have to ask yourself: "if not Russia, who?".
So, it would seem that, at least in some instances, Russia was involved in some pretty high volume, high impact cyberattacks that happened to target nations it had very unfriendly relations with at the time. It is also suspected that Russia employs some of its many cybercriminals as free-lancers of sorts, easy to disown if something goes wrong, but useful the rest of the time. As both China and Russia deploy increasingly heavy tracing and censorship on their networks, it will become more difficult to be credible when claiming no knowledge of these activities however.
Russia has a long tradition in my industry (IT) of being associated with both criminal and governmental malware. Just like Nigeria has with phishing scams. Rather than trusting overmuch in one government's claim and some breathless news reporting, I tend to believe that the ongoing sentiments of so many professionals isn't likely to be fully wrong. For example, you can listen to Risky Business, a long-running security podcast for example. 2 guys out of New Zealand and Australia, who generally held a dim view of Trump and tend towards cynicism rather than nationalism.
On the other hand, sometimes Russia means "automatically guilty, without evidence needed", as when Kaspersky, a respected anti-virus firm, got banned from US government systems. Given the level of access anti-virus software has on everything, by necessity, that might still have the right call.
In a list of recent hacks, see how often Russia is attributed. If someone wants to point to an equivalent list credibly listing US intrusions, I'd be glad to hear of it.