The story here isn't notPetya but that standard corporate practice is to put all their eggs into a single DomainAdmin basket, such that when it gets popped by ransomware, EVERYTHING (even hot backups) get destroyed.
I blame the entire infosec community. We spend so much time on the wrong causes, such as blaming "weak passwords" instead of "password reuse". Here, we blame "APT Russian hackers because Trump sucks" rather than "all eggs in the Domain Admin basket".
We feel more comfortable parroting the consensus, because it relieves us of the responsibility off knowing what we are talking about, defending our own position. So if nobody else is pointing out the Domain Admin problem, then we won't either.
