also activity like making fake sites to steal credentials, send out phishing emails/texts
It’s pretty common for that sort of activity to use stuff like botnets or compromised servers. In other words, the actual owner isn’t aware of what their resources are being used for: they got hijacked. There’s lots of stuff on the internet with very lax security so unfortunately it’s not really hard to do.