It sounds like they patched infected hosts but didn't necessarily identify or remove any command and control infrastructure. Did I read that correctly?