Military computers drastically limit which websites can be accessed and most emails with attachments not coming from another military email or contractor’s email are not delivered.
Most likely this was brought in on someone’s thumb drive as something they downloaded at home is the theory I’ve heard around here.
As for thumb drives and other externals, many offices purchase them for their senior mgmt as a way for them to work at home w/o having to take the laptop home. Much more can be lost if a laptop is misplaced or stolen.
Not only that, but they must interface with contractors and others, even within DoD, who prefer to send copies of presentations and such on thumb drives, rather than going to the trouble of burning CD-ROMS. But of course a worm or Trojan could ride back to the DoD internal net on a CD/DVD ROM just as easily as on a flash drive.