The most active ransomware crews operate from jurisdictions that decline to extradite, tolerate, or quietly task them. The result is a coercive instrument with market pricing and diplomatic distance — costs land on the target, attribution lands on a forum handle.
Policy has to aim higher
Disrupting affiliates is pest control. Changing the calculus of the states that host them — through sanctions, indictments, and infrastructure takedowns coordinated with allies — is the only durable counter.