The most plausible theory is a botnet - but probably looking to just mine and used defaults