value: The majority of the actors behind the ransomware are likely based outside of the CIS, for example, ransomware Fonix won’t run if IP geolocation is Iranian. 
name: Gather Victim Org Information: Determine Physical Locations