Some of them are probably fully automated, at least the process of the ransomware trying to grab any locally available credentials to touch as many servers as it can. These are probably the smaller dollar value attacks.

It sounds like this attack was by a more sophisticated group that compromised some initial system in that way, and then somebody actually went in to explore and determine how to spread the compromise around further. It seems to be difficult indeed even for large and sophisticated companies to defend against these types of attacks. Since somebody, or a team of people, has to do most of the compromising manually, they naturally demand higher ransoms.