The campaign relies heavily on surveillance technology, intercepted communications and digital evidence left behind by the attackers themselves