i've recently saw windows clients being binged by a huge wave of ukraines amateurs with all sort of malware disguised within tools
for example I had somebody telling me that despite his ports being in stealth somehow the Ukrainians gained access by rewriting some AnyDesk android plugin and therefore the what I've saw, traces of at least 1 individual, who wasn't that smart to cover his footing, they had control over his household Philips lighting system and personal device, all on in, with his car keys
I dismissed it and it took me 3 weeks to get his things back but sadly, not his money...
that was lost, about 70k eur and in this economy that's less but actually a lot.
so yeah my point being that, Russians do not exactly target users unlike GMbH or enterprise environments
is a reason why Kaspersky is still widely spread and sold in all Oriental/Occidental countries and even scandinavians too.
more attacks for unknown reason come directly from Ukrainians, identified 80 to 100%, China, Japan, and Italy, and small isolated parts of Spain <1%