I have a limited understanding of large scale networking. Can you explain how using a vpn to an endpoint in the Ukraine allows someone to observe behaviour?

I imagine if you are on an isp or IX backbone you could observe flows of packets. But how do you do that from a vpn?

Or should they break in to target systems first, shore up the defences, and then document who else tries to break in?