Yeah, I'm sure people that try this without understanding how to get away with it are the ones who get caught. But this stuff is big black market business now, and non-extradition countries or disputes between nations are easy things to hide behind and reap profits.
@Brandon, yeah, as they said, signatures change fast, so behavior type detect like threatfire is one way to try and protect against this.