Taken from another commenter: > according to the indictment, it was a few spearphishing emails with .docs attached, followed by keylogger and other malware ins

Taken from another commenter: > according to the indictment, it was a few spearphishing emails with .docs attached, followed by keylogger and other malware installation. Junior Sysadmins straight out of a bootcamp can negate that.