Or bot nets that do nothing until somebody pays the owner to deploy an untraceable proxy or brute force or ddos attack. There are so many reasons for bad actors to hit up as many machines as possible, regardless who is behind the keyboard.