Malware checking for VPN exit nodes

For C2, I'd like to know how common it is for malware authors to develop checks for VPN exit nodes from popular ones like Express, Nord, etc. It's hard to find any links on this, but I find it interesting that exit nodes are publicly plastered all over the net, lol.

authors etc exit exit nodes express find hard links malware nodes popular vpn