Personally, I only think a malware is sophisticated based on how it infects (like stuxnet with 4 windows zero-days, and windows update hijacking with fake code signing certificate). Spear phishing seems to be pretty boring. I think Kaspersky is just embarrassed that the malware (they say unsuccessfully) originally exploited Kaspersky AV. Also, anyone can write "complicated" C&C software. There's a lot of bundles you can find online that does most of what's listed.