Often they'll either trawl a list of IPs from somewhere (like a torrent connection, they share a movie or something and every IP that connects is recorded) or they'll scan a range looking for machines susceptible to whatever vulnerability they're specifically targeting today. Often the tards actually doing the "hacking" aren't hugely clever and don't have much of an arsenal handy, the hack is something they found on a hacking site which is why they target that vulnerability, and if that hack gets them in then great, if not they move onto the next potential victim. Once in they'll usually resort to childish damage/vandalism, or these days it's quite common for them to infect you with malware that opens up other vulnerabilities to make it easier to attack later, to act as a beacon to other attackers, and often to allow your machine to be used in a bot net for things like spam messages and DDoS attacks, which is how they make their money.
Not sure what you mean about multiple IPs on one connection, if you have one internet connection then you would normally have one IP address, if you have multiple machines behind that one connection they'll be NAT'd so only your external IP is visible - a normal LAN setup doesn't use internet routable IPs anyway.