The list of countries with a known infection suggests a Western nation acting alone, or in cooperation with others (for instance, the "Five Eyes"). Alternative

The list of countries with a known infection suggests a Western nation acting alone, or in cooperation with others (for instance, the "Five Eyes"). Alternatively, one of the infected nations could also be responsible. Infecting selected systems inside your border could be a way to deflect attention when the hunt for the malware' authors began. Pure speculation on my part, and nothing particularly new.