Informally I'd say unlikely,formal analysis? Unknown. It is also likely for APT attackers maintain an inventory of their target's network. The "scan" could very well be an APT actor testing the exploit or using it as a distraction for other attacks. It's best to list what is possible and conclude there isn't enough information to lean either way. Maybe it's just semantics but I believe retroactive analysis should not list attribution without some evidence. Proactive analysis can of course state what attackers are likely to employ specific attacks.

Their first lesson learned: "Follow good industry practices for vulnerability and patch management". Retroactive or not, this sounds like just about every article about ransomware "attacks".

> there isn't enough information to lean either way

Somebody messed up keeping their infrastructure up to date, there is nothing in the article or linked document to suggest otherwise. Probabilities exist and the probability of automated scripts scanning a network segment for known vulnerabilities is still higher than an "APT" misbehaving and rebooting firewalls. Not leaning either way is often just feeding an unrealistic picture with FUD, which I find unconstructive.

I think you miss the whole point of an analysis. It isn't to enable some public discussion. The purpose is to present facts to decision makers that will use the information in the analysis to justify changes. Proactive can be speculative for obvious reasons. Retroactive carries a muh higher weight since we're talking about what has happened not what could have or may have happened. It's important to be very clear as to avoid misinterpretation,a decision maker that isn't familiar with the subject matter might misunderstand "unlikely" to mean you know for sure more sophisticated attackers will are not likely to have used this technique (after all, you have evidence on your hands) but what you meant is statistically these attacks are more likely to be untargeted. Especially non-technical readers don't know if you're guessing ,guesstimating based on objective trends or using evidence from the attack and comparing it with known attacker TTP. That's why i made the formal/informal distinction. Informally,i know what you /author meant.

People still say script kiddie?

Why not?

Sounds like “Web 2.0” but probably just me.

I think it's meant to be an insult, so that seems appropriate.

What's the other term?