The bar is pretty low. When there are tens of millions of unpatched machines floating around on the internet, and hundreds of weaponized exploits already written by other people, all it takes is patience and lack of good judgement.