Well the more likely reason for that is that the exploit doesn't work if you have the LANG env var set. The US is the primary place where it wouldn't be set and hence where the malware would be active.