Comment by chickenfish

I guess may the compromised host was probably also use same weak password as it's Brute force other host.