The Russian Federation does not extradite people to other countries for cyber crimes, so it has became the place where essentially all of the hackers are. If your data is encrypted by someone, even if their English is really good, they are most certainly from Russia, if not Iran or North Korea. There are few places those rats can hide now a days.