They’re basically telemarketing workers with hacking tools provided by an employer. They follow scripts and click the buttons they’ve been trained to use.

I’m surprised they got in with telnet and not their usual RDP. However I’m not sure they would have gotten anywhere on a Linux box with commands that are so different, unless they were a little familiar with at least MacOS (bash or zsh based now a days).