My favorite is one of the text files on the attacker's computer:
A file labeled "Decisions and Mistakes," in which he wrote, "Going On the run / Yes / Chance of getting caught<Payoff for not getting caught / (NA) / Risk is typically underpriced in modern world.
That is just terrible opsec. The millisecond the money has moved, you need to destroy all of that equipment.
Don't worry, he also had a ""POST-EXPLOITATION" plan.
Which included, among other things, "KEEP the configs Burn the evidence, including the histfile Book flight to: Pack Bags"