In general, an attacker who wants to remain anonymous is going to use whatever mechanisms are available to obscure their identity. The technique you described-- launching attacks from compromised computers-- is a pretty common technique (see The Cuckoo's Egg for a late 1980's account of the use of such a technique by an attacker, for example). As an attacker, the goal is to make it administratively difficult enough for third parties to trace you back through the "hops" that your commands are moving through. Stack up enough hops through compromised machines (especially when they're in "backwater" countries with out-of-date laws about computer crime) and you make it difficult to discover where the attacker actually is.
As far as actually controlling the compromised computers, the attacker may use some already-installed program that listens for incoming requests. With OS's like Windows, though, that don't typically have TELNET or SSH daemons, its more likely that the attacker is going to leave some malicious software behind.
I'm not aware of off-the-shelf VPN tools being used in controlling compromised computers, but its certainly possible.
IRC was used, for a long time, as a "command and control" network for compromised computers. The compromised computers would logon to an IRC server, join a specific channel, and wait for commands.
Command and control networks in modern "bots" are getting fairly complex, and use public key encryption to authenticate commands. Further, there have been some "bots" with capabilities to detect tampering in the command and control network and, ultimately, launch DDoS attacks against someone who tries to forge command and control packets. (Pretty sneaky, that...)