Yes, the attacks go both ways and are occurring all the time, especially against high value assets (e.g. high traffic government, military,business websites and point of sale and industrial systems). Most of these attacks are fully automated and only call back to their owner when they detect something of interest for further investigation.