My speculation on this is that China/Russia/whoever targets ISP's in order to identify people by IP that have come to their attention somehow. Your credentials aren't the only point of interest, your credentials gives up subscriber information name/email/address/etc. That's pretty valuable from an intelligence standpoint.