I think you’re conflating a wide range of things: most attacks aren’t linked to those countries and the ones which are often take time to link. Ransomware attacks have been happening frequently for ages, but most of them don’t reach the level where they’re being classed as infrastructure attacks — they’re gangs of opportunists looking for easy money. You find them in countries like Russia because there are only a few places which don’t cooperate with US/EU law enforcement, especially at the level where someone without powerful backers can rely on it. These guys caught a much bigger fish than they were prepared for and weren’t anywhere close to being prepared for a nation-state to seriously pursue them. Anyone trying this from most other countries would either be caught or much better at staying hidden.