exactly. Look at stuxnet - nobody knew it was an attack until it was over!
If there are millions of people trying to ransomware businesses and hundreds of important businesses with really bad security, depending on how talented the best hackers are - the odds could be quite high you get hacked by a not-so-talented hacker.
Even if you’re completely amoral, getting a hefty paycheck, 401k, etc. is going to be appealing to most people with that skill level. It’s not a coincidence that a lot of this happens in places where people have poor career options which makes that more appealing.
There's enough self-styled cypherpunk infosec experts that might insist on being paid only in BTC and then lose their decrypted wallet...
this is a true criminal SaaS, partly because its low risk, high reward for the developers and partly because its a russian funded op that needs to cover its ass in the nature of its attacks on democracy and corporatism.
What would you do if you were a foreign intelligence service? Participate in attacks yourself?
No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idiots, it makes people think the claims of your connection to the crimes are even less likely.
Tricks and disinformation are the name of the game.
If you actually were elite, you would hide and practice and save your actual actions for critical moments and not show your hand for a few million dollars. Or you'd go into security consulting which is a far safer, more profitable, and overall smarter thing to do.