It has been common knowledge for years that most malware and ransomware look for the presence of a Cyrillic keyboard and exit quietly if it’s found.
So clearly it's well known that this is real and accurate just as most of the reporting is on Russia.
Except when it turn out to be fake news as it usually happens. For instance, linked malware research paper doesn't mentions alleged keyboard layout probe and never reveal how this probe to be performed. So, bogus.
> workarounds e.g. adding an additional keyboard
Just as bogus as placing succulent plant to "protect from computer radiation"
The effort required to make your enterprise look like it’s in Russia is definitely not worth the effort given that this would only stop one slice of organized crime.
Instead, there are stats indicating that The Mother Of All Hoaxes definitely ISN'T safe haven infosec-wise.
Additionally, Krebs completely forgot what there is war between Ukraine and Russia, so there are no reasons for such alleged protective measures any more.