Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.

Cool theory but that should result in other attacks that peak in February too, can you give examples?

Oh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.