We have been seeing this kind of thing pretty much since Bitcoin became worth something in 2010. The only thing that tends to change is the cryptocurrency being mined by the botnet, and the infection vector.

With the absolutely enormous number of machines impacted by MS-17-010 (ETERNALBLUE) and the related DOUBLEPULSAR implant, its unsurprising that it is being used for infection/spreading. As for the choice of Monero, Monero mining is incredibly profitable if you are not paying for the resources being used (i.e. botnet mining).