- Steal application credentials if posix perms or database privs are weak, attempt privilege escalation, install rootkit RATs Remote Access Trojans for persistence and hiding processes.
- Install Proxies, DDoS Agents, Bitcoin mining, proxy to SMTP servers, etc...
- If anything looks interesting on their console they will log in and poke around. The order of these events depends on the sophistication of the bot script. Most are very simple.
If you the target look like you have money they may install ransomware and encrypt some of your files. Now I want to watch the Beekeeper again as corny as it was, also a fun movie.