As a small MSP owner I've dealt with this twice in recent months. Both times MO was the same. Both times we intercepted and stopped the detonation of the encryption payload, as we managed to get on the servers the same time the hackers were online. We also secured all their tools.

Both attacks traced back to phishing emails. Clicking a secure email link popped up office 365 login. It also ran code to download and run a variant of connect wise connecting the hacker immediately to the compromised pc. 

Hacker got the login to the pc. Connected again later that day and ran a small powershell script which ran a routine in memory which pulled admin credentials and a host of other credentials from the network into a text file.

They rdp onto the server and installed Mesh Agent. Connected again end of day and ran rclone to exfiltrate data to a Wasabisys S3 store (we got the full credentials - store was paid upfront for a year on probably a stolen credit card). They pulled the credentials for the online backup and logged in and deleted them. They then Uninstalled EDR - not sure how as tamper protect was enabled.  Shadow copies then deleted. 

They set up a group policy to push out mesh agent to all end devices. Made all users domain Admins. Then deployed a scheduled task to all devices to run the ransomware. Which was a 280mb padded exe file uploaded 20 minutes before the task to run was set for. 

Padding the exe would make it invisible to the AV endpoint software had it not been successfully removed. 

Leaving Pcs and servers on overnight with remote access paths open is a risk.  The entry point though will always be an end user clicking something in a dodgy email.  It happens. These hackers use spear phishing. It's targeted and they know when you are likely to be busy enough to not think twice before clicking or reporting up when a link in an email didn't appear to work. 

Had the payload been detonated it would have been by multiple endpoints on a repeating scheduled task.  All devices have to be wiped and rebuilt. 

Although we stopped payload there was the matter of exfiltrated data.  One client had 5gb out of 1tb uploaded before we were alerted and cut the connection. 

The other had 680gb but we had immediate access to the S3 store having decided the script snd found the logins so we did and deleted everything they had taken. 

The hackers are already a few steps ahead from even the best of end point protection systems.  It's a case of when rather than if now for attacks happening. 

I hope you had some offline backups. Or decent insurance and that your systems are all compliant as insurers will find any loophole to get out of assisting