Saudis used their nationals inside Twitter quite brazenly. Imagine how many other rouge nation nationals are there being used by their governments.
Apples to orangutans.
there are more cases that nobody publishes about - a lot of "ransomware" incidents - are actually employee who suddenly received email with malicious URL and clicked on it infecting his work computer - gaining plausable deniability by being "dumb IT user" while collecting $$$$ from criminal org for granting them initial access.
a lot of smaller/obscure outsource IT companies can cause you ransomware incident if you decide to terminate software development contract with them, because these could be literally North Korean hackers working as your sysadmins [2].
1. https://cpomagazine.com/cyber-security/hacker-offered-russia...
2. https://apnews.com/article/north-korea-weapons-program-it-wo...