We all know that Russia (and China,Iran,etc) refuses to extradite or punish cybercriminals, no matter how bad, as long as they don't attack their country.
Is the reverse also true? In other words, if an American was caught hacking or defrauding Russian corporations or persons, would there be any legal consequences?
I know the USA will not extradite, but could there be civil lawsuits or other punishments?
The US has extradition treaties with 110 countries, and lacks treaties with about 88 (depending on what you count as a country). We have no extradition treaties with the above mentioned countries, and generally speaking the US does not extradite except under terms of a treaty (see discussion here), following 18 USC 3184. There are provisions allowing extradition of those who are not citizens, nationals or permanent residents of the US, and are accused of crimes of violence against nationals of the United States in foreign countries.
In contrast, there is no federal law pertaining to enforcement of foreign judgments against people in the US, so you have to look at the particular laws of the state, or federal government in case the federal government could have jurisdiction. One vehicle for enforcing foreign judgments is a version of the Uniform Foreign Money-Judgments Recognition Act, which is enacted in various states such as RCW 6.40A in Washington. Enforcement of judgments can be blocked or optional according to circumstance, for example it is blocked if "The judgment was rendered under a judicial system that does not provide impartial tribunals or procedures compatible with the requirements of due process of law", and may be blocked if "The judgment was obtained by fraud that deprived the losing party of an adequate opportunity to present its case" or "The judgment or the cause of action on which the judgment is based is repugnant to the public policy of this state or of the United States". So while the US has no extradition treaty with Botswana, their legal system is compatible with ours to the point that a judgment in Botswana might be enforced here.
Another option, successfully pursued (sometimes) in China is to sue in Chinese courts, such as this (copyright) case. A Russian copyright case (Universal Music and Warner Music sue ni Russian court) is here.
We need to make a distinction between criminal legal consequences and civil legal consequences.
Extradition is only applicable to criminal matters and depends on the specific treaty between country A and country B. If they don't have one then there can be no extradition. Similarly there are clauses that are common enough that they can be considered typical, for example, extradition will not be allowed by country A if:
For the particular case of Russia, the Russian constitution prohibits extradition of Russian citizens. Therefore, there is little to no incentive for other countries to negotiate an extradition treaty with Russia.
Civil matters are not subject to extradition treaties and a person in country B wronged by a person in country A can bring a lawsuit in country A or country B or country X, Y or Z if the activity is subject to the jurisdiction of the courts of those countries. For example, consider a dispute between an Australian mining company with a French supplier using an American transport company to supply a mine located in South Africa - any or all of those countries could have jurisdiction.
Having brought and won the case in, say country A, the plaintiff needs to collect from the defendant. If the defendant has assets in country A, no problem (or at least just the usual problems), however, if all the defendants assets are in country B then the plaintiff needs to ask the courts of country B to enforce the decision made by the courts of country A.
This may be relatively straightforward or it may be fiendishly difficult.
