It's really hard to track down the perpetrator unless they make a mistake. Even if you tracked the perpetrator down, there is a very good chance they are in Eastern Europe or some other country/region that will not prosecute or extradite them.

So basically it's almost certainly a waste of time for law enforcement and they mostly don't bother. If they did, we would see command/control moved inside Tor and it would become even more difficult to track (AFAIK this already happens in the more sophisticated botnets).

The appropriate analogy is probably something like fake check scams. Illegal, but difficult to trace and likely to lead to a dead end.