Article does mention Chrome 0-day Vulnerabilities (CVE-2021-21166 and CVE-2021-30551) and a Office Vulnerability (CVE-2021-33742). Knowing these were targeted a

Article does mention Chrome 0-day Vulnerabilities (CVE-2021-21166 and CVE-2021-30551) and a Office Vulnerability (CVE-2021-33742). Knowing these were targeted attacks, It could have been as easy as sending a innocent looking email with a innocent looking link (something like blacklivesmatters[.]info). That combined with the Windows privilege acceleration attacks, could get the spyware insane amount of access. Considering these individuals (politicians, journalists) probably dealt with a lot of mail everyday, this could easily have gone undetected. This really gives you a perspective on how big this company is, having the resources and incentive to do these exploits instead of reporting it.