They somehow replicated the intranet site so I'd call that somewhat sophisticated. That kind of feels like they had insider knowledge.

> As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.