Once I was hired to clean up after a site breach. From logs I could watch the attackers spend an hour learning how to exploit some vulnerable php code, then le

Once I was hired to clean up after a site breach. From logs I could watch the attackers spend an hour learning how to exploit some vulnerable php code, then learning how the customers admin area worked. Then they changed the html on some rarely seen pages to include google ads point to an account controlled by the attacker. And that was it - no trace of any other monitization or destruction. The site in question was selling $1,000 a pop training courses via authorize.net. Given the access the attackers had, they could have run off with so many credit card numbers. In a perfect free market for crime, this would never happen. A break in criminal would sell access to the organization that could extract the most “value” from the target. But as it is, many exploiters do not have the connections to do this, and so usually follow the same “monetization” pattern on target after target.