Both the financially motivated crew and Tehran's APT groups excel at social engineering attacks, and are proof positive that cybercriminals don't necessarily need to use zero-days to inflict damage.