You are correct, the Krebs article I cited does not say that. But it's my strong hunch. There was much discussion of the poor state of Baltimore's IT infra (s

You are correct, the Krebs article I cited does not say that. But it's my strong hunch. There was much discussion of the poor state of Baltimore's IT infra (see https://www.baltimorebrew.com/2019/05/21/baltimores-out-of-date-and-underfunded-it-system-was-ripe-for-a-ransomware-attack/ https://www.baltimorebrew.com/2019/05/21/baltimores-out-of-d...), and at the same time Microsoft released a patch for an RDS flaw (CVE-2019-0708, https://msrc-blog.microsoft.com/2019/05/14/prevent-a-worm-by-updating-remote-desktop-services-cve-2019-0708/ https://msrc-blog.microsoft.com/2019/05/14/prevent-a-worm-by...) which says "Vulnerable in-support systems include Windows 7, Windows Server 2008 R2, and Windows Server 2008. Downloads for in-support versions of Windows can be found in the Microsoft Security Update Guide. Customers who use an in-support version of Windows and have automatic updates enabled are automatically protected. " So unpatched servers are where I'm laying my money.