Criminal charges under CFAA to actual CEOs of actual companies doing this, with long jail terms.
Criminally charging Russian and Chinese does not work. The solution would be to drop these contries off the internet if we want to play hard.
The US cannot even stop NSO to hack the system with spyware and Israel is a political ally.
I don't know if I ever recall seeing a CEO go to jail for practically anything, ever. I'm sure there are lots of examples, but at this point in my life I have kind of derived a rule of thumb of "if you want to commit a crime, just disguise it as a legitimate business" based off seeing so many times where CEOs get off scott free .