“GRU operatives began hacking into various subsidiaries of Burisma Holdings, apparently looking for emails or other documents”

Link. Planting “evidence” more likely.