Do you think CVE-2016-7255 is the culprit? Let enterprise audit firm Deloitte hit by cyber-attack causes information leak.The vulnerability which allows hacker do the code injection on both 32- and 64-bit versions of windows server and workstation OS before Nov 2016. If this is the root causes! How does the customer defense until Microsoft issue the patch. Even though security vendor IDS Yara rule not defined such pattern yet. As a result there are more victim afterwards! For more details on Deloitte  cyber security incident, please see below url for reference:

https://www.theguardian.com/business/2017/sep/25/deloitte-hit-by-cyber-attack-revealing-clients-secret-emails