The perpetrators, who will likely never be identified or brought to justice…
Why not? If they have a business entity, they must have an agent in the state where they incorporate, and one little subpoena will find them. Domains are supposed to have identifying data too, but I think that can be spoofed.
If they don’t have a business entity, and you sue them, you can take not only the business, but the home, the car, every damn thing. Get busy, Reddit!