I think it's often a combination of technical and non-technical vectors.

Here's a video of Phineas Fisher hacking a police union a while back:

https://tune.pk/video/6528544/hack

How he took down Hacking Team:

http://pastebin.com/raw/0SNSvyjJ

General guide:

http://0x27.me/HackBack/0x00.txt