There are only a few countries which don't extradite cybercriminals to the west and don't prosecute them for foreign attacks - so these few countries are very attractive from which to run such operations; and even for international crime organizations it's good to have the "dirty work" done from such places, where the grunts won't get arrested and be motivated to sell you out for a plea deal.