Some are reaching into C2's that support metasploit staging and are executing to learn. There are a few stagers dotted around online just to collect, no interaction, just collecting their IP addresses to share
- If you're into blocklists here's one
- Push Automated TI to become richer
- Highlight interesting signal (non CTI)
Honestly, I didnt know why randoms where joining my teamserver, once I understood it, I thought 'Well, what can I get from this?'