They knew about it for a few months (likely monitoring it for more info) and decided to yank it the day before the UNGA, publishing the story the day of the meeting. It may be a message of sorts given the timing. "We see you." It could have been normal crime but it also could have been state sponsored. You set up the sim farm, let criminals use it and if the state entity needs anything they just check backdoors or utilize the botnet like capability when they need to for an op. The criminals who operate it don't need to know who their benefactors are. If it gets found by local authorities, it's just regular local criminals and not say, China or Iran, etc.