The trojans make the intruder undetectable. He would not show up in any of the logs, systems processes, or file structure. He builds a comfortable and safe home where he can blatantly scan the Internet. These attacks are not limited to a certain time of the day. Many admins search their log entries for probes that happen late at night, believing this is when black-hats attack.
Script kiddies attack at any time.
As they are scanning 24hrs a day, you have no idea when the probe will happen. Also, these attacks are launched throughout the world. Just as the Internet knows no geographical bounds, it knows no time zones. It may be midnight where the black-hat is, but it is 1pm for you. The tools used are extremely simple in use.