the federal crimes part is irrelevant if its below the threshold of federal authorities actually cracking down on them and figuring out entire chain.

just because credit card theft and other types of scam are illegal

I remember how ddos attackers created "DDOS protection" companies to protect their victims against DDOS.