How do malware authors hide communication between client-side exploit code and their backend servers?

So I've been listening to quite a few darknet diaries episodes lately, and episodes that talk about malware have brought up one big question for me.

If a threat actor writes a remote access trojan or something like that, and then sends out a phishing email to get the victim to unknowingly install this RAT, how does the communication between the client-side program and the attackers' server where they have a database with the collected info for example, not make it obvious who is carrying out this attack?

I mean, wouldn't some reference to an IP address or domain name have to be present in the client-side program, which could be extracted, even if it takes some effort due to obfuscation?

From what I can guess, the attacker would maybe have some proxy servers, but even then, that seems like it would barely slow down an investigation.

For context, I'm a programmer but don't know a ton about networking and cybersecurity, and I'm curious as to why these people aren't caught easier.