New
#10
I had this curiosity too, and spent some time searching for an answer. Which was surprisingly tough.
But the common thought from several sources was that it is propagated the old fashioned way: someone clicks on an unknown attachment.
They only need one user on one computer on the network to do it, then they are in.