I agree with joof. I consider this grey tipping towards white rather than black hat. s/he basically just automated default credentials or autologin attempts, the door was already wide open and there were already numerous pieces of evidence s/he wasn't the only person to know that. If you see a door wide open a curious hacker will look.