Oh yes, that's definitely a long game - detecting a compromise often takes a long time, attribution is tricky and takes time, and after that court cases will take years, e.g. the ongoing whether-NotPetya-is-act-of-war insurance civil case.