[dawnerd]

Just about every exploited site I've had to deal with has been some form of crypto miner.

[da_chicken]

Sure, because there's no reason not to, and because crypto mining is noisier than data exfiltration.

That doesn't mean it's the most lucrative revenue stream.