The [Computer Fraud and Abuse Act][1] applies to "protected computers", defined amongst other things as:

> [...] used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States [...]

The interpretation of "[affecting][2]" is very broad. AIUI if a computer sends packets over the Internet, and those packets enter the USA, then the computer has affected foreign commerce or communication of the United States. They don't need to be sent to a computer inside the USA; merely passing through a router on USA territory is sufficient, and it might even be interpreted to include a router owned by a USA company on foreign territory, as that would affect commerce. The size of the effect may be minuscule, but as long as it is not zero the computer that sent the packets is "protected".

In your scenario the foreign computer must have sent packets to the criminal, so it must have affected US communications. Hence the law enforcement authorities would have a case under the CFA. Whether they would pursue that case in practice depends on a bunch of factors, including the amount of harm done, the likely costs of conviction, and probably political factors to do with international legal cooperation.


  [1]: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
  [2]: https://en.oxforddictionaries.com/usage/affect-or-effect