This is an old attack vector. No one is learning from history. The organizations being hit have poor cybersecurity.
https://en.wikipedia.org/wiki/2008_malware_infection_of_the_...
https://en.wikipedia.org/wiki/2008_malware_infection_of_the_...
At the time the morris worm had inspired some folks to see if they could spread binaries by infecting every disk inserted. That’s all it did….. spread. I think the virus lives off an interrupt generated by disk insertions.
Fortunately it was harmless (except for a few extra crashes) and I had my original OS disks that could be booted from to clean up the disks.