Qstrategy's comment is my main theory as well, but some addition thoughts:

It's also likely a good sting operation from what I've been reading where those dormant IP's could be spoofed/misused somehow by threat actors (super illegal to do with military property, as you can guess).

When they all lit up it was not only like shining the batsignal on a bunch of kids elbow deep in the cookie jar, catching unauthorized users' information as best they could as they try to pull out.

Another theory is that it's also a sting in that it's now broadcasted, publicly-known web space, and is ripe for poking and prodding. Who knows what tech DoD has that could be lying in wait to capture/link/ID threat actors. If this ends up being a white hat op (which all signs seem to indicate) the I hope it's all of the above.