Most accounts created before sometime in 2018 likely have just 5000 iterations and not 100100. Since the iteration count is kept in the clear an attacker would likely begin with them (with the added benefit of an older account might have more data in it). So the likely steps an attacker in possession of the vaults would take:

1) Find all vaults with the lowest iterations

2) Order by some criteria (known money sources: URLs for banks and crypto, known URLs that would have PII information: utilities, telcos, governmental URLs)

3) Start cracking...

Or they could skip all that for some quick money. There's no need to crack anything if the URLs can get you money. How much would a dictatorship pay for the identities of everyone with an account at a URL that posts negative information on the regime? A domain.com/wp-admin account could certainly get you killed.

Just out of curiosity I booted up a box with 10x RTX A6000 @ 451.6 TFLOPS

    Speed.#1.........:    38789 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#2.........:    39017 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#3.........:    38894 H/s (11.16ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#4.........:    39254 H/s (11.02ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#5.........:    38626 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#6.........:    39448 H/s (10.94ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#7.........:    39256 H/s (11.06ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#8.........:    38966 H/s (11.14ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#9.........:    38870 H/s (11.17ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#10.........:    39259 H/s (11.01ms) @ Accel:128 Loops:64 Thr:64 Vec:1
    Speed.#\*.........:   390.0 kH/s

Used the same example as the author with 100500 iterations. I think with some good wordlists, I'd wager a ton of low hanging fruits will be wiped within a reasonable time. If we're talking a threat actor with $$, they'd do some serious damage on this dump.

*edit: just wanted to clarify that I think bruteforcing this dump wouldn't be as useful. It would still take a crapload of resources to be effective or useful in that scenario.

So you're doing 4e10 hashes per second or 390k password guesses per second. At what price per hour?

Used vast.ai for this setup: $5.875/hr. Using their API you can likely find better deals and launch a series of different setups and optimize your spending. Hope that helps.

To be fair I don’t think nation state actors care about the bill. Be it US, China, Russia, Saudi, etc.

Do you get extra credit if one of the first accounts you hack has a cloud provider account credentials that you can then spin up more machines to further the attack on someone else's dime?

I have access to 34,000+ GPUs, right now.

All that I need to do is pay for power, which is at lowest rates.

Who wants to crack some hashes?

Where are you where power is at its lowest rates?