or now based on the fact that russian state-owned company transtelecom is now working with north korea, i mean, you could have those kinds of thefts directly and indirectly. they're kind of vague in terms of who did it and where the smoking gun is. but after you go after our power grid and you shut it down, that's a little more direct of an attack. that's kind of a declaration here. >> if you're trying to track back technically looking at who's doing it, it's going to be the same technical means to see where the attack is coming from. you rarely see the last hop to an attack actually come from the bad actor's computer. they're going to compromise someone else's computer. a lot of the attacks that happen in the u.s. that are based from overseas, the attacking computer is actually in the u.s. but it's compromised, it's a bot. from that standpoint it could come from anywhere. in terms of the motivations, we have seen the lazarus group over the past couple years focus on financial gain that has coincided with when the sanctions have gotten worse. the ransomware, wanna cry, there was some s