The hackers behind the malware appear to have been selling the hijacked computing power on the mining platform NiceHash, according to Palo Alto Networks.