Mailing a bunch of "free" and "promotional" USB drives, prepared with zero-day malware, would probably work too. Especially if it was official looking.
zero-day malware probably makes malware writing sound difficult. Bypassing fingerprint-based scanners is reasonably easy with the use of 'packers' (which can be bought from hacker markets for pretty cheap, or built pretty easily). Bypassing heuristic based scanners is a little more research-intensive[1], but some 'packers' do this too.