Aside from random blokes like this guy, there are nicer targets. For instance, in this group, people discuss "import-replacement big data startups": t.me/startupbanya
Sounds like a nice development team to penetrate and insert vulnerability into their codebase.