Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos