I've found claimed evidence outside of the government's reports, but it is still dubious. The government reports still contain absolutely zero evidence linking any leak or theft of emails back to Putin.
The virus identified by the company that the DNC HIRED (hired to say whatever the DNC wants, so beware) is based upon an application written by a Chinese company in the early 2000s. The security company was able to download the source code to the virus - hence anyone was able. The source code to the virus has been available online for anyone to download and compile.
I do believe Russian hackers use this virus (X-Agent) but I do believe it's origin and use are impossible to attribute solely to them.
I repeat, the source code was freely available online for anyone to download, compile, and I'll add: modify to suit the needs of hackers.
The virus was compiled on a linux system with the language set to Russian. But it's only circumstantial evidenced of any link to the government there or to Putin. Anyone with access to the source code could have compiled it. It could have been compiled on a server in Russia that was hacked by an American hacker. And not all Russians who hack are at all involved with the Russian government - for example, there are Ukrainian hackers who target the Russian government all the time.
It's also important to note that this virus is suited for email phishing schemes, not for the attack that succeeded against the DNC server. It has the functionality to act as a client application to fetch email (as Podesta or the user who's been hacked) only, iterate through the company directory (LDAP, if you understand me), and so on. The original chinese company's software is remarkable in its range of capabilities for such a small footprint (less than 2MB in size, compiled).
The spear phishing attack that Podesta (or his secretary, associate, whoever) fell for was tracked back to a single btly account. That is a service that shortens URLs, giving you a new short URL that links to a much longer one. So you can use on Twitter without using up your 140 characters as fast. Shortening a URL with .ru domains would obfuscate that the user would be viewing a page on a server in Russia (or Poland or Maryland).
This btly account was not password protected, and contained 4000+ links apparently targeted toward the DNC, DNC actors, and US government agencies. The claim is that this limited and focused list of targeted email addresses implies a specific interest by only the Russians (well, any foreign intelligence agency for that matter).
What's left unsaid is why not password protected, how they know these were solely targeted at specific emails, and if there were a 2nd, 3rd ... hundredth other btly account with more links that might have been served (sent by email) to completely unrelated people.
Not password protected is something a serious hacker would not do if it left a true trail that could lead back to the hacker. Rather, these btly accounts could be created by automatic means by the hundreds or thousands if need be. This makes much more sense. The specific 4000+ links and emails these were sent to seem consistent with what I suggested earlier - the virus went through the contact list of Podesta or someone who had Podesta in his/her contact list, generating a btly link for each one.
Some of the linkage to the Russian government is historical patterns of attack. I'm not sure how previous attacks were attributed to the Russian government in the first place, so this linkage needs to be substantiated to have any relevance at all. This specific virus has been identified by typical malware detection programs (e.g. your Norton, Windows, whatever antivirus software) for quite a while, indicating that all sorts of people have receive the virus.
In fact, I received a phishing email from a friend. I deleted the email and emailed him to let him know he was hacked. I don't work for the government or the DNC.
He then sent this email to his entire contact list:
WaPost (or was it NYTimes) ran a story yesterday saying new evidence has come to light further connecting these hacks to Putin. The evidence was intercepted emails showing the Russians were happy Trump won. Sorry, but there are billions of people who are happy Trump won and these celebratory emails were not damning at all. If they said, "our hacks worked!" it would be an admission of guilt and I'd agree Russia was involved.
There is other evidence that the security company claims as truth that does not appear to be truth. For example, they claim this virus is nearly identical to one deployed by the Russian government as an android app/virus. The purpose of that virus is to provide position information of Russian tanks and troops and so on. Turns out this android app/virus had none of the capabilities the security company claimed (such as GPS).
Another very important point: The DNC refused to allow the FBI access to the infected server and client machines. This alone raises a big red flag. Why not? And if the government had no access, how can they be certain the hack happened as was claimed?
I repeat that the government has provided no hard evidence of linkage to Russia or Putin. They don't have to produce everything they have, but even one convincing bit would lend them any credibility at all.
Plus, even if the Russian government hacked Podesta and the DNC and Hillary's server and every Democrat in the country, there's no evidence they were the source of information released through WikiLeaks. Any person with access to the machine and a USB drive could have copied all the files and delivered to WikiLeaks (through a 3rd party or whatever).