> On the bright side, using these weapon grade malware is burning exploits and also showing current state and techniques of Russian cyberwarfare which defender can learn a lot from.

Or perhaps they used an already-known malware to measure defensive capabilities without showing any of their cards.