Especially when you, or a partner service of yours, has access to compromised servers from that region to spread said malware from a server that can be attributed to "the bad guys™".

Like it's the case with the NSA: http://www.networkworld.com/article/3137065/security/shadow-...