[dathinab]

they don't

worse hacker do like using jump hosts

so wherever you "hack back" to has a good chance to be another victim

it's also a good point to remind people that most cases of "knowing who was it but not catching the people behind it" are either wild guesses without proof or the attacker leaving recognizable traces (like a literally "it has been us <group>" note /not a joke). But the problem with that is any other advanced enough hacker group/apt could also have made it look like that...