Sanctions cannot be very finely targeted and will always hit other groups as well as the cyber attackers. The chances of knowing specific individuals who were responsible are next to zero so those individuals cannot be targeted directly. This is the whole problem with cyber-attacks; they are very difficult to pin down. In the best case then sanctions are applied against the right target and happen to hit others as well; for example hackers are not the only new who want advanced computer equipment. At worst the sanctions will completely miss their target; it would be a major embarrassment for a country to impose sanctions for a cyber-attack only for it to later be discovered that the sanctions are against an innocent party through whom the attack had been routed.