A 16-node SSH botnet runs a nine-command triage script instead of dropping a miner — looking for Telegram Desktop session files, GSM modems, SMS spools, and SIM-management config, the hardware and data of SMS-fraud and 2FA-interception operations. It is a botnet that grades every host it lands on before deciding how to monetize it.