Honestly, many of them are in nations where they are working for a state-sponsored cybercrime agency and have few other options, if any. North Korea and Irania

Honestly, many of them are in nations where they are working for a state-sponsored cybercrime agency and have few other options, if any. North Korea and Iranian gov'ts are major purveyors of ransomware; I've known many clients who were breached by them (FBI guys said it was usually one of them each time). If not, it's probably Russia or China, especially if it's a higher-value target. If it's just a private citizen flinging exploits at ip ranges, it's possibly Brazil too. Honestly, it used to be Eastern Europe, until we started realizing they've got some serious programming talent and contracted some work out. Now it's less bad, though still a bit sketchy. Of course, this doesn't help nation-state attacks.