What do you do in the case the actor is using a weak state as cover? Send a surgical strike into a country that aside from having the presence of the bad actor had nothing to do with it?
Here's the plan: invade Afganistan, and eventually find the guy years later in a compound in Pakistan.
Within a country, the same methods would be enforced. If for example, T-Mobile allowed unfettered abuse of its pre-paid wireless cards as they do then the countries they reside in would de-list them from BGP advertisements. The government would have legal immunity in doing so. Or if AWS, DigitalOcean, Linode, OVH, etc... allowed people to abuse their VM's, same deal. De-listing might start with a region then become global depending on the level of abuse and how seriously the company responds and takes action to take out the trash.
In my humble opinion, anything short of this would just be meaningless political posturing and the problems would continue to grow and escalate.
Work with law enforcement agencies in those countries to apprehend the person. If the country won't cooperate or shields the attackers, then sure, a drone strike could work.
Second, there's no moral absolutes that dictate how a nation should act. I value the lives and information of my family and friends more than I value the lives of someone attacking them. Don't like it, don't attack... :shrug:
You said it, not me.
What's your obsession with my penis? This is your second comment about it. I ignored it the first time, so you try harder the second time? You're a creepy dude.