From the looks of the Twitter thread pointed out by @ 0xDEFC0DE, looks like the ransonmware was spread by Active Directory group policies, probably by organized crime, as opposed to a random drive-by download infiltrating an entire organization.