Not actually legal, but commonly ignored by the authorities, especially if those hackers also are willing to play on the national team (aka hack for the Russian authorities). It's the reasons that some malware (example) has functions that automatically shut it down if it detects use of Russian language on a target, e.g. a computer where the word processing application is installed with a Russian language package or a virtual keyboard in Russian. By setting those limits, they reduce the risk of incidentally hitting a Russian target and pissing off the Russian authorities.

Less legal and more russia isn't going to let anyone extradite you to the EU or any other country really. And you generate enough trouble they'll just make you state sponsored instead as suspected with some of the more prevalent ransomware groups operating out of Russia.