Start from the countries on the list: Russia, Saudi Arabia, Mexico, Ireland, India, Afghanistan, Iran, Belgium, Austria, Pakistan. The percentages added up to 100, a surprise because I would expect at least one or two percent to be "other". That makes me mistrust the figures a bit.
"Significant" countries not on the list include: the US, Canada, Britain, Germany, Israel, Japan, Australia, France, Turkey, Yemen, Iraq, Syria or any of the smaller Gulf States such as Qatar, Bahrain, Dubai. What is also interesting is that Snowden has said nothing about it.
That makes it look a bit like a co-production to me, one state organisation produced it but they shared it with at least one other country.
Russia being top back around 2008-2011 implicates some of the main western countries.
Saudi Arabia being so high on the list implicates Israel, Gulf States, or possibly the U.S.
Austria could possibly point towards Israel.
Afghanistan, Iran and Pakistan point towards the U.S.
Mexico being up there implicates the U.S.
Ireland? The only reason I can see for them being on the list is Transatlantic Cables. The GCHQ would maybe care that much.
I would expect the country which produced this to have infected some servers in their own country, to deflect suspicion.
Finally, one significant political event in 2011 was the fall of Mubarak in Egypt. If they were behind it then the dates when it was inactive would make sense, so would the subsequent reappearance. Do they have the ability?