The actual blog post clarifies this as well. But still in some sense these organizations share some level of responsibility if it is their machines, attacking from their ASN.