I can't speak for hackers, but cybercriminals use exactly the same systems that you and I would typically use. There is nothing surprising in that area. In ter

I can't speak for hackers, but cybercriminals use exactly the same systems that you and I would typically use. There is nothing surprising in that area. In terms of OSes, seized hardware almost always hosts either a Linux Ubuntu, sometimes Kali but not that much, or a Windows 10 system. They always have VMs running, almost exclusively on virtualbox. Running non-mainstream systems would just make them more discernable from everyone else which is not good. What differentiates regular users from cybercrime is their "opsec", aka their operational security. They encrypt their data (with an actually robust key), they patch and harden their OSes (nobody else does this), and their online presence is mostly exclusively run through third party systems, which they likely compromised already. Honestly, you'd learn far more useful things by reading court decisions, they often include very interesting details about their opsec.