An exploit chain always begins with scanning and enumeration. Attackers use automated tools to discover what is hiding on port 2222: