You've got a language mixup, which others have been sharing.
Legal is not a unitary entity. If it was an official Russian policy, then it was legal IN RUSSIA. This doesn't make it legal in the US.
The actions of the CIA are frequently illegal in the country in which they occur. This doesn't make them illegal within the US.
And action can be taken against someone in court only in the place where the action is illegal. I used to be able to say and only for actions that were illegal where they occurred, but US precedents, e.g. the case against Kim Dotcom, have removed that constraint. Now you could be tried in a Thai court for slandering their king, convicted under Thai law, and have extradition applied for even if you never set foot in Thailand. I consider this an extremely harebrained precedent, but the US has established it multiple times. And this means that if they could identify the perpetrators, presuming they are Russians and in Russia, and have never left Russia, they could be prosecuted in a US court, and a request for extradition could be sent for them. I don't know what extradition treaties the US has with Russia, but I believe that Russia is attempting to join the EU (has joined), and I think that there's an extradition treaty involved in that. So potentially the "accused perpetrators" could be extradited from Russia to the US under treaty for doing something that was legal and part of their official duties within Russia to be tried in a US court.
STUPID, STUPID, STUPID, STUPID, STUPID.