I think that probably only one of them is the enemy. Stuxnet, for example, hit computers in half a dozen countries but only deeply penetrated in Iran (by design). So two of the countries might be collateral or they might be deliberate misdirection. The target could also be a non-state actor with a distribute presence.

One doesn't need to be an enemy to be a target of surveillance.