Yes, correctly identifying the perpetrators would be very challenging.

I get that it's easy to suggest solutions but hard to implement them. I just don't see how the security situation gets better without escalating the response. Does anyone else? How does this get better?

I hear that, and yes, it's funny, but as you point out not entirely wrong. These attacks harm businesses and the families that depend on them. The tens of millions of dollars paid in ransom go somewhere, that money would be less valuable if it came with the real chance the military would hunt you down and kill you.