Accidentally Stopping a Global Cyber Attack
It sounds like the mere existence of a specific DNS A record was the kill switch for the ransomware.
That seems like a pretty bad kill switch, surely the attacker should have required some sort of password to deactivate the ransomware.