We had an intrusion on some dev boxes. The vector was an open management service on some public facing Tomcats, deployed open by accident. The intruder installed a custom Tomcat container that apparently sent some 443 traffic to a .cn domain. We figured they got some class files, not much use to anyone without the rest of our products. We never got to see their actual payload. So we killed the instances and that was that.
A week or two later, a few of us at $work got recruit pings on LI from a Chinese company to work abroad. None before or since. We figured either it was a coincidence, or whoever got our class files wanted some help learning how our product worked.
Sounds like the digital version of Number Stations: https://en.wikipedia.org/wiki/Numbers_station