Re: "But it does look like a campaign which requires large investment or financial backing"
Both "broad based" and "spear phishing" but with limited regional distribution being run by botnets herders? That doesn't strike me as the right psychological profile. State-run or State-linked sounds more like the right psychology.
Given the prevalence of Stuxnet and Flame in the area and that Madi isn't using it, I'd guess the relationship with whatever state is linked to the the hackers is tenuous. If it was closely linked to the state I'd expect them to have had samples of those viruses and be working with them.