It doesn't have to be targeted. NotPetya was a Russian GRU hack aimed at Ukraine that just happened to spillover into becoming the largest worldwide cyber attack in history.

Like i said, do business in ukraine or related entities then be especially on alert. Companies like maersk did business there during notpetya that had spillover. More alert than usual, IR plans reviewed for this.

Instead of overtly strategic hacking, isn't the more likely scenario a green light being given to Russian-NSO types to ransom and thieve to their hearts' content?

Not NSO types but regular criminal groups. They already have access to many US orgs just not enough personell to do the hands on keyboard hacking (as opposed to malware).

They will do a ton of hacking but it's not like them to do it just for the sake if making noise. They will posture and distract but at any scale thry will have a strategic objective.

Be worried about everyone else that is expecting you to waste efforts worrying about russians when you don't have to. What immature teams do is setup too much monitoring, geo block russia,etc... introducing a false sense if security and alert fatigue at the same time.

If you haven't already, work on good detections for lateral movement, ransomware and wipers. If you have, just another tuesday.

Uh, the idea is that Russia would use widespread and indiscriminate cyberattacks to punish sanctions. That would make almost everyone a target.

It's not in apt28/29 MO (gru/svr) to do that, they outsource to criminals that do this already everyday. Being alert is reasonable but any mature team is already prepared for this. You don't panic when you are prepared is my point. They don't need a war to spread wipers, if you are not ready after wannacry and notpetya...