Their first lesson learned: "Follow good industry practices for vulnerability and patch management". Retroactive or not, this sounds like just about every article about ransomware "attacks".
> there isn't enough information to lean either way
Somebody messed up keeping their infrastructure up to date, there is nothing in the article or linked document to suggest otherwise. Probabilities exist and the probability of automated scripts scanning a network segment for known vulnerabilities is still higher than an "APT" misbehaving and rebooting firewalls. Not leaning either way is often just feeding an unrealistic picture with FUD, which I find unconstructive.
I think you miss the whole point of an analysis. It isn't to enable some public discussion. The purpose is to present facts to decision makers that will use the information in the analysis to justify changes. Proactive can be speculative for obvious reasons. Retroactive carries a muh higher weight since we're talking about what has happened not what could have or may have happened. It's important to be very clear as to avoid misinterpretation,a decision maker that isn't familiar with the subject matter might misunderstand "unlikely" to mean you know for sure more sophisticated attackers will are not likely to have used this technique (after all, you have evidence on your hands) but what you meant is statistically these attacks are more likely to be untargeted. Especially non-technical readers don't know if you're guessing ,guesstimating based on objective trends or using evidence from the attack and comparing it with known attacker TTP. That's why i made the formal/informal distinction. Informally,i know what you /author meant.
> there isn't enough information to lean either way
Somebody messed up keeping their infrastructure up to date, there is nothing in the article or linked document to suggest otherwise. Probabilities exist and the probability of automated scripts scanning a network segment for known vulnerabilities is still higher than an "APT" misbehaving and rebooting firewalls. Not leaning either way is often just feeding an unrealistic picture with FUD, which I find unconstructive.