group probably bought its tools on a Trojan-trading site
One thing that script kiddies fail to understand is that its pretty hard to actually stay anonymous the moment money begins to move about.
They should have spent some cash and got one of those special HSBC accounts.......