The attacks are overwhelmingly simple rather than complex.
The most common vector of attack is through phony emails or Web sites that employees are lured into clicking on.
Once clicked, the malware finds places to hide in ordinary software like Microsoft Internet Explorer or Excel spreadsheets. The malware will have access to the same information as the legitimate user of the machine.
The tools available for creating and using this malware is readily available on the Internet.