Very small differences in performance can be detected over the network as long as you have enough samples. Given that every port 22 is being hit by a gazillion

Very small differences in performance can be detected over the network as long as you have enough samples. Given that every port 22 is being hit by a gazillion attempts per day already, sample count shouldn’t be an issue. So if distinguishing infected machines was their intention they definitely over-egged it.