Is this baseless? I.e. it is known that both China and Russia (together with other ex-USSR space) has extensive and flourishing cybercrime economy, and enforcement there in that area is very weak. So I wonder for a random victim of cybercriminal what is the chance the latter is indeed a foreigner?
Also I assume the research was done before Snowden revelations, where it was known that foreign governments engage in cyberwarfare, but there was not known US government does the same and the US government denied it does. Reinforcing the image of the threat as the foreign one.