I've noticed that some reports on malware mention that a certain malware or exploit kit (RIG TK, step 2 for example), limit their scope to certain countries or actively avoid infecting other countries such as Russia. I've read about the victims keymap being used to identify the their location, but don't know how else it could be done (I imagine via IP, system language, etc.).
I imagine that it's partially due to nationalistic/political ideals and partially to try and make it harder to detect or analyze by researchers. Why else would someone avoid infecting specific countries or limit their infection to others?