[jcrawfordor]

By far the most common vector of state sponsored attacks is simple malicious email. Why waste your time and money when something simple works so well?