What always interests me in these type of cases is how do hackers get identified? Aren't they savvy enough to use some sort of proxies to cover their tracks?
It only takes 1 mistaken connection for it all to fall apart.
It only takes 1 mistaken connection for the parallel construction hammer to drop
Subpoenas and cooperating third parties can de-obfuscate proxy chains.
Hack a wifi, connect longer-range radio IoT module, link it to your base, attach it to a firework rocket, hide it inabush near the target wifi, hack, ???, ignite.