I wouldn't believe a word out of this known liars mouth without evidence. It makes little sense for Ukraine to bite the hand that feeds them, so to say. It could very easily be Russia trying to frame them. Evidence is necessary!
You don't DDOS through a VPN. The first D is for distributed, you do it from a multitude of devices, often hacked ones from a botnet. So DDOS attribution is hard. And if you want some scale you reflect the attack on some other machine that runs a service that allow for amplification, making attribution even harder.