I'm not sure what is currently beeing used, and I guess that really depends on what exactly you are doing. But I know that often infected Computers are used as a VPN or Shadowsocket to cover ones tracks. Combine that with several layers of protection and it gets harder and harder to track one down