What IP Do Hackers Use When Making a Backdoor.

So lets say that a hacker is trying to make a backdoor and he needs an IP address. Does he put his own IP address or does he use a VPN or maybe something else. I'm just curious, because if he puts his own IP he could be easily tracked by his ISP. And if he uses the VPN option, what's the chance of the VPN service revealing his true IP. Thanks in advance.