Many ransomware attacks originate from a different nation than their target. One could arguably classify these attacks as a threat to national security, albeit primarily in an economic sense. When they hit medical targets though, it inches closer to basically profit-driven terrorism.

With that said, I'd love to see the full power of western signals intelligence loosed on these attackers. If they're going to spend our tax dollars on domestic surveillance, may as well get some use out of those programs.

I've often thought using these capabilities for early detection of active shooters might not be the worst idea either, granted it's far more of a legal and ethical gray area there, at least in the US.

Foreign ransomware attackers who target medical systems however, should pretty much receive the same classification and treatment as normal terrorists. If they're beyond any reasonable legal jurisdiction, then extrajudicial means should be used to eliminate them as a threat. I'm not saying torture and assassination, but messaging. Most for-profit criminals, after they realize they've been targeted and identified by an intelligence agency, will probably change their ways pretty quickly, or even end up being turned into assets.