Some sanctioned countries are financially motivated. But they also tend to sit on zero-day exploits worth billions so they probably don’t want to be detected before evidence is destroyed completely. They will be very careful what to do.