The geographic targeting patterns you've documented here are really interseting. NoName057(16)'s sustained focus on Spanish transportation infrastucture shows how these groups are becoming more strategic rather than just opportunistic. The fact that government adminstration faced 75% DDoS attacks while still seeing initial access operations suggests defenders need to worry about both the noise and what might be happening quietly behind it.