Now, if I repeat what you told us, someone might say:
"My friend told he read somewhere that someone read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets."
This isn't a rumour and I don't share information unless I'm either personally trained on the topic or have learn that information from a reputable news source. This feature in question even included interviews with some individuals who have ran ransomware attacks.
The only reason I said "somewhere" in my original post was because I cannot remember which network it was published on.
Its OK as long as gossip fit "progressive" agenda and/or comes from renowned "progressive" newspaper Pravda. Otherwise it is a racis' conspiracy.
That WaPo Krebs article links malware analysis which goes into dire detail on how that ransomware probes for Volume Shadow Copy (via amateur WMI) yet... omits keyboard layout probe method(s) at all (there are at least 3 possible ways)
"My friend told he read somewhere that someone read somewhere that a lot of these attacks are orchestrated by Russians because the Russian authorities will turn a blind eye as long as such attacks don't hit domestic targets."
How rumors becomes "real"... :)