Small correction: not "some hackers", but some malware families (the difference being that the check is automatic). And honestly, not "some" but "most of them"

Small correction: not "some hackers", but some malware families (the difference being that the check is automatic). And honestly, not "some" but "most of them" :). Though I often see this implemented by calling GetKeyboardLayout, so this will only work if you actually use the Russian (or neighbourly) layout when malware detonation happens.