It seems bizarre to me that a crypto miner got in. It wouldn't make much money on regular CPUs, and the high processor usage would immediately draw attention. So it looks like a low-effort botnet, which is embarrassing to get pwned by.
(The coin mining could be a cover like you mention, but it seems unlikely since it naturally draws attention.)
(The coin mining could be a cover like you mention, but it seems unlikely since it naturally draws attention.)