Until we put people in prison, the cyber crimes will continue.

Declaring states that do nothing about these criminals as harboring terror is a good start. This is the same legal principle that resulted in the https://en.wikipedia.org/wiki/Barbary_Wars which stopped Barbary pirates enslaving US sailors.