[specificcc]

How the hell do you even target specific countries / groups within countries? Is it literally just scanning an IP range and cross referencing with geolocation to get the targets? What happens then? Is it ddos'ing, pentesting, what?

Nah, I think they knew what they were targeting specifically. I'd say targeting a country is too broad a term. Pentesting is the closest to what they were doing, but I think that's an understatement.