While hill staffers and other washington movers and shakers were being carpet bombed two years ago during budget negotiations, it was really eye opening how much individual effort was put forth. They were exploiting a flash 0-day that was embedded in various .xlsx .docx and .pdfs - pretty slick as it got them around noscript policies and outside any sandboxes.

The turn around time was crazy - on at least two occasions the workflow went:

recent victim gets first/early copy of policy paper written that day --> document is taken, translated to a different format and has 0 day inserted --> emails with exploit are sent to no more than 10-15 people the victim frequently discusses the topics covered in the paper with. --> Many include personalized notes that include observations the victim had sent to the author --> Time from initial email receipt to exploits all mailed: around 3 hours

Now that's how you get a 95% open rate.

related: http://contagiodump.blogspot.com/search/label/CVE-2011-0611