The most common things I observe:-

- Installing a cryptominer or persistence tool

- Sending spam (smtp)

- Using pre-obtained credentials to log into various ecommerce/social media sites