Ransomware groups play a game of attacking the most valuable targets they can, without attracting so much attention that three letter friends start having meeti

Ransomware groups play a game of attacking the most valuable targets they can, without attracting so much attention that three letter friends start having meetings about them. Crypto is a necessary component. And then many ransomware implants will also refuse to run on systems with RUS locale, for instance. The understanding seems to be that groups can avoid attention of local law enforcement as long as they do not make any waves locally.