
I can actually imagine that attacking Russia could be very profitable. Because the Ransomware Scum there dont dare attack locally, I can imagine the average Opsec for any non-governmental, non-military contractor firm would be absolutely minimal.
OK definitely avoid the government and military contractors, since no doubt they already are high targets for practically every nation state actor (including Russia's "friends" like China and the Norks), and likely have great opsec (and the backing to make sure it's done right!). But your average business in Russia is likely far below the standard level in the West due to the lack of threat actors operating against them. Whether they have the money to pay anything, as their economy collapses is another question entirely...