That's too elaborate. They like more direct attacks. Think subpoenas exploiting the third party doctrine to the hilt, MLATs to image any server remotely suspicious outside the USA, and occasional direct hacks.