E.g. with stuxnet they got to the air-gapped machines by letting worms loose on the network of suppliers, targeting technicians laptops.