It does happen commonly. There was an entire mining botnet operating for weeks using the same CIA exploit that the Wannacry attackers used. It made a lot more

It does happen commonly. There was an entire mining botnet operating for weeks using the same CIA exploit that the Wannacry attackers used. It made a lot more than Wannacry did. Wannacry's ameteurish and public ways led to patches that both exposed the existence of and killed the botnet.