We had an old CGI host recently compromised for bitcoin mining, a southern China IP had installed a bot: 100% CPU usage for a couple of hours before we noticed. Maybe a few cents here and there for very little effort on their part?