18
Monero interest seems coming from offshore countries
(monero.town)
Data from google trends.
As pointed out here it could be VPN locations. But on an other side we also can see tax heavens who's may struggling over coming regulations.
What if we target this userbase ?
Most of APTs are not really skilled about opsec usage. Last biggest actor were Lazarus and they did the mistake to not use bisq. LockBit for example is still using Bitcoin
Idk anything about their specific infra or procedures/practices tbh. I just know that threat researchers love lookin through crypto public record/graphs and correlating them fuckers