This was my question also. Typically you do not allow servers Internet access and even where you do it is via an authenticated proxy to an approved set of URLs.

This was my question also. Typically you do not allow servers Internet access and even where you do it is via an authenticated proxy to an approved set of URLs. If there was traffic to a C&C this would be come fairly obvious especially in a spray and prey type attack like this where it is hard to control where the infected servers go it is surprising that there is no evidence presented of this being detected. Your servers or endpoints contacting unusual internet addresses and especially setting up tunnels is something any monitoring system would be looking for