It's often through a single mistake made once that allows you to link some pseudonymous profile to a real person. For example, I recall reading about a particular case where some command&control server was identified and being monitored, and once one of the operators accidentally logged in to his personal profile on a social media site over the 'secure VPN' connection.

Also, there have been cases where authorities have been 'subcontracting' certain services or tools from local cyber criminals working on online financial fraud - where those criminals were later arrested abroad, and have agreed to testify against their former partners/employers.