The key point there is that all the recent major events generally are not an automated attack by a simple virus, in such situations the malware opens a command&

The key point there is that all the recent major events generally are not an automated attack by a simple virus, in such situations the malware opens a command&control link that is [ab]used by multiple skilled people for weeks to gain persistence, move laterally throughout the network, find systems and user accounts with elevated privileges, disable monitoring and backups, deploy to all machines just as your administrators can (because at that point they are the de facto admins of all your systems) and only "pull the trigger" of ransomware when all the prep work is done. In the case discussed in this article, attackers took three months between the initial compromise and the ransomware attack. One can do a lot in that time.