"During our investigation we were provided an archive containing files that were stored on the C2 server." I find that more interesting than the article itself

"During our investigation we were provided an archive containing files that were stored on the C2 server." I find that more interesting than the article itself. Some unknown entity just happened to hack the command server and drop a dump of it in their lap?