In fact, the DOJ press release specifically names a bunch of countries that aren't the US https://www.justice.gov/usao-edwi/pr/man-charged-his-role-cr...
>According to publically available information, since it was created, Kronos has been configured to exfiltrate user credentials associated with banking systems located in Canada, Germany, Poland, France, and the United Kingdom, among others countries.
Of course, given the nature of the malware it's very likely that at least someone in the US was affected.