I think you are exactly right. Any solutions to this have to be technical and largely defensive. Legal or diplomatic solutions will only bind parties that intend to follow the law. Counter-attacking and deterrence will fail if the attacker is not defending much of anything, so that approach might work against states and state-backed actors, but not against non-state actors.