Hackers: Ditch the malware, we're in... Just act like a normal network admin. *Whistles*

Nmap in hand, they're soon working pwned systems like a boss - study

Hackers almost exclusively use standard network admin tools to move around a compromised network once they've broken in using malware or other hacking techniques."