> DC doesn't go after these "security consulting firms located in non-signatory states" just precisely because they want to be able to use them

You are vastly overestimating the federal government’s coherence and coördination. Yes, we use black hats. Yes, we still jail and sanction them.

Which is straight out of Macchiavelli's playbook.

The first thing you do after conquering the throne is to bundle up all your pending atrocities in one and eliminate competition. The second thing you do is slaughter the mercenaries you had hired to win your war of ascension.

No reason to leave them around and let the next usurper hire them to dethrone you.

In practice, it typically happens across administrations, i.e. the effect is accidental. (We forget what an asset having a fresh executive every decade makes.)

IIRC feds have gone against companies using some third-party consultants to pay a ransom that eventually went to a entity on US sanctions list like Iran or North Korea. Or at least they have loudly threatened to do so.

Also, there have been some enforcement actions on intermediaries for facilitating such payments - e.g. https://home.treasury.gov/news/press-releases/jy0471