It has been seen spreading cryptojacking malware and in attempts to steal cloud credentials from compromised machines.