@GossiTheDog You mean, they drop webshells?
The reason I asked is because I haven't seen stats of how many devices are compromised - only how many are vulnerable or how many are trying to exploit.
If the only way to detect a compromised device is to access it via the webshell, this could explain this lack of statistics - it would be essentially hacking into the device, which would be illegal.