The activity has been attributed by Recorded Future's Insikt Group to a threat actor tracked as TAG-140, which it said ...

Threat actors leverage exposed JDWP interfaces for code execution and cryptocurrency mining, with global scanning activity ...