Depends on what the hacker wants to obtain. From what we saw, they prefer techniques such as phishing, social engineering and credential stuffing.