China, mostly.
It's not exactly some small, shady group you're going to be tracking down and exposing. It's the same scene it's been for ages.
Gold selling/account trading is a multi-billion dollar industry, and Blizzards titles are a large bulk of it I'd imagine. It's new age credit card theft, big bucks, little to no repercussions.
People who don't want to download/buy an auth are better off just not playing Blizzard games, because at some point you will trip up and someone will get an exploit off you, log your information and that'll be that.
This has been happening for years at the same frequency in World of Warcraft. While there's not much you can do to defend against it, it is
Blizzard's fault for new responses of confusion when they're not properly educating new customers about the issues with this, especially for an online, item driven game.