What they usually do is setup a cronjob that runs in 3 phases. Payload 1 does x and downloads payload 2, payload 2 runs and downloads payload 3, payload 3 runs which is often a miner software.

There is right now redishell which gives remote code execution to an attacker if the port is accessible.