I wonder what can be changed to help find and prosecute the distributors of malware? By the way I think that the ones held responsible and paying for the damag

I wonder what can be changed to help find and prosecute the distributors of malware? By the way I think that the ones held responsible and paying for the damages should be distributors, not malware developers especially if they did not know exactly how it would be used. Making malware is like making a gun, it is allowed in some countries. Maybe it will be used for good purposes.