They will be pack if you pay. The only safe payment is in fbi tracked money. then track the guilty down and put them in prison (or what ever reform program). If the country they live in won't give them up that is an act of war and send NATO in.
In practice, cyber attacks dont seem to trigger even discussion of article 5. It will be interesting to see if we reach a state where they do
There was a discussion of including cyber attacks as military action before 2020 among NATO leadership, iirc.
Wasn't a hot news item some 4+ years back that US decided to include cyberattacks on the list of acts that potentially warrant nuclear retaliation?
You might think about geopolitics a bit too much if you reach for article 5 because of cyber crime, maybe a bit too much wargaming in your head, things are kind of tense these days and I dont think invading a country would be an appropriate or mature response.
This is a war, just a cyber war.. these groups are russian backed.