Accoring to [1], Palo Alto Global Protect VPN was somehow involved/used as a vector.

1: https://www.computerworld.dk/art/292143/verdens-stoerste-it-...