If that were true, it should be easy to block all the crypto attacks coming from Russia, right?

Even now, hospitals (for example) could just whitelist their own country IPs, block Russian ones, and bam! No more Russian crypto ransom attacks right?

Wait, why haven’t they just done that already? Could it be that IT teams are already taking this precaution but attackers, especially ones with state funding, can route their traffic through IPs not attributed to Russia?

Again, are you that naive?