They mostly weaponized themselves, in a sense. Before the 2022 invasion (yes, even after 2014), the entire post-Soviet cybercriminal space, including the Baltic

They mostly weaponized themselves, in a sense. Before the 2022 invasion (yes, even after 2014), the entire post-Soviet cybercriminal space, including the Baltics, was tightly connected (not just ransomware which is a recent thing but also carders, DDoS-for-hire, scammers, etc) and everyone has been outsourcing parts of their "business" to everyone else. What media used to call Russian ransomware gangs were in most cases loose networks of criminals scattered all over the place. As the war started, they quickly separated and started attacking the legitimate infrastructure of the other side and also their former accomplices.