Criminals, and even government cyber armies use what works. Period. If a pre-made tool works, then why invent a new one?
This is very well recorded. I did a search for "chinese army metasploit" and these are some of the results:
A lot of them are opensource, you can grab the latest version of Metasploit and extend its modules for example, so yes, even bad guys use the tools good guys use, even on Defcon you see the top white hats and the gray / dark hats.
But in order to be really good at this as I've seen in most of the articles I've read about security, most of the good tools are ...
Yes, Black Hats use ready-made tools.
The reason for this is simple. These tools had a lot of effort put into them to fulfill a wide variety of tasks very well. Sure, any hacker could write their own HTTPS proxy, but Burp does that already and does it probably a lot better in a fraction of the time it would take a hacker to write even a simple proxy.
Hacking tools are available and used by everyone, good and bad. In fact, releasing these tools to the good guys is helpful so they can develop protections against them in real attacks.
Of course, there are also custom/specific purpose tools that are NOT widely available as well.