Dr. Stephen R. Covey wrote in his famous book the 7 Habits of Highly Effective People that fast is slow and slow is fast. What he meant was that you can't rush things you want to actually work. You have to take your time, go slow, and do it right.
This is the very spirit of an Advanced Persistent Threat attack, or APT for short. Unlike malware which targets a vast group of people in the hopes of getting any information possible, an APT attack targets very specific organizations and even very specific individuals inside that organization. For example why target an entire company when you could target just the accounting department and taylor your attack to get to the exact right people. Using tools like Linked In would give them the perfect starting list of targets.
Or maybe they send you a file that appears to be from your spouse over email. They learn this information by searching online information like real estate records, friending you on Facebook, or masking what phone number they are coming from. Any number of ways are possible to get into the network.
These types of attacks are so direct the only way to actually protect your company is to install detection systems on the network. I have the honor this week to participate in a webinar session with WatchGuard as other industry experts on this very topic and what companies can do to protect themselves.
Every organization is at risk of these attacks. Governments, accounting offices, law firms, manufacturing, real estate...the list goes on.