A U.S. sentencing tied to an Oregon state government network shows that in cybercrime, a valid foothold can be treated like merchandise even when the original breach details remain unclear.