[mdhb]

There is often a sizeable non public component to some of these things that is firmly more in the gray zone.

For example knowing that there are few legal options to deal with Russian groups who were doing ransomware attacks on hospitals there was recently a public name and shame campaign that lots of people had this exact kind of response to but the actual way they were looking to impose costs on these groups was by making sure that other crime groups in the country were very aware of who these people were, that they didn’t have any meaningful protection but they did have a lot of crypto money that would be very easy to rob from them. The idea was to put them in harms way since as the theory goes it would cause others to think twice.

Tactics differ obviously depending on the target and what options make sense but this was for a non state backed group who didn’t have anything other than a cyber component to them.