Sometimes it's old code. Sometimes they're just full of it. But sometimes, threat actors hit pay-dirt.