We have several servers hit with the mining malware and were able to clean, but we also had 2 sites with all the files encrypted and extension was .locked.
All occurred last night.
Was able to resolve with backups from previous night.
I think it’s related somehow, if not directly maybe another took advantage of the compromised machines.