I didn't think about exfiltration - good point. I guess they could just host their own instance on <insert compromised server here> like the good old days.