[dclusin]

Also, what kinds of attacks are they trying to catch here? The bullet points in the article seem like phishing scams. Phone verification doesn't seem like it would do much since a sophisticated adversary has probably also compromised the phone network as well.

[jcrawfordor]

By far the most common vector of state sponsored attacks is simple malicious email. Why waste your time and money when something simple works so well?