Why does some malware limit their scope to certain countries?

Question

I've noticed that some reports on malware mention that a certain malware or exploit kit (RIG TK, step 2 for example), limit their scope to certain countries or actively avoid infecting other countries such as Russia. I've read about the victims keymap being used to identify the their location, but don't know how else it could be done (I imagine via IP, system language, etc.).

I imagine that it's partially due to nationalistic/political ideals and partially to try and make it harder to detect or analyze by researchers. Why else would someone avoid infecting specific countries or limit their infection to others?

Answer 1

Not sure if @Fis is joking, but he's not far off.

1. One thing we know about Russia for example is that the government doesn't care at all if a Russian hacker defrauds US citizens or institutions, but if that hacker (accidentally or not) targets a Russian bank, the fury of the State will come down upon him hard. Israel has similar "do it over there, but don't do it here" laws.

2. Damage control. If you write malware to steal USD from US banks and it spreads like wildfire in Africa and Southeast Asia, security researchers will be alerted and your target audience will catch on prematurely. And you'll end up with a bunch of Zimbabwe dollars you can't do anything with. It's safer to perform some sanity checks to see if the malware is in the correct environment before detonating the payload.

Answer 2

It's conceivable that malware operators incur some operating expenses, just like any other internet "business". If the "service" costs a small but real amount per "customer" to provide, then they only want customers who can afford to pay. The fact that they block russia means that, for one reason or another, they make less money from russian computers.

The cause could be russian retaliation, but it could also reflect a culture in which devices are not as trusted or deeply-invested in, making a factory reset more appealing than a payment. If someone's "whole life is on that laptop", they are more likely to pay whatever it takes. perhaps the average russian is more pessimistic or cautious about what they enter into such devices in the first place...