Been there, seen that
I was called in at a setup in London because they had a major infestation. For starters, they had a global network without any segregation so a virus infection would spread quicker than Covid in a room of heave breathers, and this one duly did.
We set up separation and started cleaning up, keeping an eye on progress via a laptop running etherape (it's a simple tool, but a broadcasting virus shows up very well). After a few days we had a reasonable state, but we had two sources of broadcast left. One suddenly emerged and was quickly traced to a boardroom location where one of the very high ups from Far Far Away was giving a presentation (which got interesting politically), one was persistent and a swine to track as nobody knew what it was (I did mention a way too flat network). Eventually we figured it out: it was the switchboard, which was running a rather old version of Windows and had managed to pick up this virus too.
Took quite a bit of brute forcing before the vendor decided that maybe an update was a good idea - the suppliers were only set up to sell an appliance, not to do anything more intelligent so it took a while to get through to the actual manufacturer.
