While I’m not an expert in this area, it is also possible their cyber campaigns specifically target improperly defended industries. Attacking a target is much easier than defending one, that is true in every field and most industries don’t take their cyber security very seriously. A cyber attack that is funded and sponsored by a large state like Russia is sure to find many victims. Most industries are easy targets because they have thousands of people who are not trained in to defend against even the most basic of cyber attacks.

And of course only the successful attacks make the news, the unsuccessful one are never reported.