Evidence indicates that the attackers leveraged existing endpoint management software rather than malware to wipe devices.