They didn't shut it down immediately, they run it for a few weeks collecting information.

It's quite likely that they've used it to either directly compromise or unmask real world assets of it's users beyond what would be possible from just reading some logs.