They probably are. I used to write software for a financial institution and we saw a lot of traffic from Chinese and Russian IP's hitting our firewalls constantly (ssh login attempts with typical default passwords, random wordpress exploits, that sorta thing). It wasn't very sophisticated so I don't think it was state sponsored or anything, probably just random cyber criminals trying to hit US targets because their governments wouldn't care.