Nobody knows for sure what they were doing since the script dropped via the salt vulnerability downloaded new scripts and executed them every 60 seconds. Just

Nobody knows for sure what they were doing since the script dropped via the salt vulnerability downloaded new scripts and executed them every 60 seconds. Just because all they found were crypto miners doesn't mean it was the only thing it was doing. And also there were multiple groups exploiting this vulnerability at the same time as was evidenced in one of the scripts trying to detect and eliminate competing scripts dropped by someone else