They knew about it beforehand, or at least they knew it was coming. MS released there monthly patches a while back, and then reports came out of virus code in work around the internet. A couple days after the new MS patches came out I started getting stuff like this from CERT, SANS, MS, etc. in my inbox