The crime group would likely rent a distributed proxynetwork to obfuscate their true locations and to run transactions against the compromised accounts.
According to the Swiss security researcher who runs Abuse.ch, the use of free proxy services like Glype, Tor, and others have an option which allows administrators to log the traffic flowing through their proxy server on the Glype network.