Crims backdoored the backdoors they supplied to other miscreants. Then the domains lapsed

watchTowr Labs re-registered dozens of expired domains that had been used to host web shells and backdoors, monitored incoming requests, and discovered thousands of compromised systems (reported as over 4,000), including government and higher-education hosts; the research highlights how abandoned infrastructure and backdoored web shells allow attackers to "mass-hack-on-autopilot" by effectively hijacking prior attackers' access.