You can do the gateway on a PC thing. You don’t even need to have collaborator to do that, plenty of people run outdated systems riddled with malware.
But once you need actual working SIM (Telegram, Watsapp, etc…) you really need that SIM somewhere in Ukraine. And you need plenty of them. (see the pictures in the article, there’s a ton) At minimum to activate the accounts and more realistically for occasional re-verification. (2fa) Sure you can then run actual bots in russia, but that need for physical presence is still there at least occasionally. The article mentions 100 individuals, when you consider that 150k SIMs were there, most of the operation indeed was in russia or somewhere else.
The triangulation is just a way to maybe correlate multiple SIMs in the same spot by Ukrainian officials once they had enough suspected malicious SIMs. (So that they know it’s not just few random persons with malware on their phone, but it’s indeed huge concentration of SIMs in one spot)