Don't know if same exploit was used to deliver it: https://securityaffairs.co/wordpress/66813/cyber-crime/transneft-monero-cryptocurrency-miner.html