But how do you get the malware on the servers? Most malware spread by tricking unsophisticated users into install them. It is much harder to trick a system administrator to so. Exploiting a vulnerable public facing service is the alternative. However, that option is out of reach to all but the most dedicated attackers, assuming you keep the system updated.