Global cybercrime actors generally adhere to the same principal as a handyman: If its not broken, dont fix it. When malware works in one area, attackers want to use it to target a new audience or geography. Zeus, Neverquest, Gozi and Dridex were the most active by attack activity across the world in 2016. In some geographies, local cybercriminals are collaborating with their more advanced counterparts in other parts of the world to learn how to improve their own malware.”]
Source: https://securityintelligence.com/churn-under-the-surface-of-global-cybercrime/