Using a known vulnerability, the threat actor is listening to a variety of ports.
Source: Threadpost