https://motherboard.vice.com/en_us/article/yw5yp7/monero-mining-wannamine-wannacry-nsa

https://f5.com/labs/articles/threat-intelligence/cyber-security/zealot-new-apache-struts-campaign-uses-eternalblue-and-eternalsynergy-to-mine-monero-on-internal-networks

They are going from ransomware to mining I think.