Looks like they left the connection logs on a public folder on one of the web command/control servers. From the PDF - The C2s maintain a detailed, encoded log

Looks like they left the connection logs on a public folder on one of the web command/control servers. From the PDF - The C2s maintain a detailed, encoded log of the victims connecting to the servers. The logs are available to anyone who knows the exact filename. By collecting the logs from all the known command servers, we’ve discovered connections from several high profile networks belonging to ...