They don't even need funds if they're good at finding exploits. Plenty of idle devices around to run on.