It's not in apt28/29 MO (gru/svr) to do that, they outsource to criminals that do this already everyday. Being alert is reasonable but any mature team is already prepared for this. You don't panic when you are prepared is my point. They don't need a war to spread wipers, if you are not ready after wannacry and notpetya...