An attacker leveraged wget, curl, tftp, and ftpget commands to download scripts from different sources, including web servers, FTP servers, and even non-standard ports.

Lmao.