I apologize for the length of these posts... Weekends get boring, and I tend to ramble about these things.
It doesn't really take much. For a nation-state attacker, it takes almost no resources in comparison to a foreign-based physical operation.
First, understand that there are two different kinds of attacks being discussed here. The DNC hack was a general APT penetration, while attacks on SCADA systems (like Stuxnet) are usually more targeted and require more expert knowledge. Since they work hand-in-hand, I'll describe a mix of the two in a major hypothetical attack.
Let's suppose Strong Badia wants to attack Elbonia. Strong Badia first launches a campaign against several technology companies in Lower Slobbovia, with phishing bait emails trying to get internal credentials. They use those credentials to compromise public-facing servers, and use those servers to launch more attacks against Elbonian companies. That second round of attacks looks like it comes from Lower Slobbovia, so it's more difficult to investigate. This multi-stage effort relies on automated tools (available for a few thousand dollars) to exploit common software. Since the phishing mails are sent in bulk and do indeed rely on luck to get hits, they're automated for scale. They can be run by one social engineer working part time, who usually just needs to wait until he gets a few particularly useful credentials.
With credentials in hand, Strong Badia turns to making their presence persistent. A small number of experts (two or three, even) establish more permanent access credentials, and plant malware that they can use to restore access if it's ever disrupted. This effort is targeted to a specific network infrastructure, but again most of the tools are automated. This time, they aren't automated for scale, but rather to hide their presence better. Attack packages can be uploaded and held, hiding their traffic from monitoring systems. Again, this is only a couple of people to decide which servers (and users) are worth attacking and map out the Elbonian network.
In the case of the DNC hack, that was about all that happened. The attackers gained access to the DNC, became persistent, and copied out documents. As I recall, there is evidence (in writing style, level of expertise, and preferred attack patterns) that the DNC hack had up to a dozen operatives. Other attacks get more complicated.
If a target is "special", it might need a more customized approach. For the sake of analogy, this is the point in the heist movie where the crew realizes that the bank's security is something new, and they need to recruit that quirky specialist to get the job done. They'll go out and buy a copy of the bank's vault, posing as a wealthy individual who just has to have the best protection for their widgets. Similarly, in out hypothetical attack, this is where Strong Badia claims they need the latest and greatest in Elbonian technology, and purchases a SCADA system just like what their target has. While the purchase of such equipment does indeed take some effort, I don't count it as part of the attacking force. The purchasers would likely think they're actually purchasing equipment for a legitimate construction project, so it's a little unfair to count them against the trained spies.
With equipment, an expert in that system (our fourth Strong Badian team member) can begin reverse-engineering it to find new zero-day vulnerabilities, and perhaps with the aid of another Strong Badian, he can turn it into a malware package for that target.
That malware can then be handed back to the APT team, who have the understanding of the Elbonian bureaucracy. They can create fake problem reports that require a call to tech support, and the social engineer can assist in making it seem legitimate. To jump an airgap, they might need a participant in Elbonia, but that could be a simple matter of attacking the Elbonian support subcontractor in a similar manner, and such an attack could be executed by the very same five-man band.
What's sarcastically great about APTs is that they can wait. Unlike saboteur employees, they don't have to show up to work every day. While their SCADA expert is working on the malware kit, the social engineer is phishing the technician contractor, and the persistence guys are establishing a presence in another Elbonian company. Meanwhile, the malware in their primary target sits and waits for their next instruction.
The team can repeat this process over and over again. As the Elbonian support tech gets calls from around his country, he installs system updates as they appear in his Elbonian-SCADA-R-Us.com FTP site. They look legitimate to him, and he's happy to be getting calls from so many different customers.
Eventually, a critical number of systems are infected. At the predetermined time, the logic bomb goes off, and the systems shut down. In a grid sytem like the electrical supply, other systems would normally take over, but they've all been timed to shut down at once. The remaining systems can't handle the load, and they shut down out of preservation.
It took Strong Badia a few years, but Elbonia goes dark, because of the work of five people. The subsequent investigation stops at the technician, because his computer has been nicely loaded up with documents declaring anti-Elbonian sentiment and expressing a strong desire to move to Lower Slobbovia. Meanwhile, the Strong Badians are celebrating (quietly) a job well done, and they're ready to apply their talents to the next target on the list.
In contrast, consider the cost of this attack being done with a more hands-on approach. First, Strong Badia would have to have some kind of Elbonian presence to recruit Elbonian spies. While recruiting could be done online, the Strong Badian recruiters wouldn't have any way to tell if their conversations were being played right in front of a room full of Elbonian investigators. Having a physical presence also means Elbonia knows exactly who to watch.
If they can escape scrutiny, they can start grooming a spy. Insider threats are extremely capable, since they rarely have to worry about gaining initial access, but they're also risky, partly because decades of James Bond movies have made espionage into a pick-up line. Training a good spy means a lot of one-on-one coaching to sufficiently alter their morality until they want to do the job, and moving slowly enough that they aren't so excited to be a spy that they'll go tell someone. To convince the Elbonian to even do anything against their home country requires several months. To ask them to perform major acts of sabotage like planting a bomb would require more effort.
The Strong Badian brainwashing/indoctrination/radicalization process involves having the handler be available to talk, to convert the Elbonian's loyalty. It needs (roughly) a handler for each spy, and that spy has to go to work. That means that for each targeted site, Strong Badia has to pay a handler and bribe the spy, and hope that the spy's induced disloyalty doesn't get them fired before the planned attack.
For one or two sites, having a physical attack is reasonable, but it quickly becomes more efficient to run an APT attack, instead, since such targets can be controlled and kept waiting for years with basically no upkeep. Weakly-protected targets (no airgaps, unpatched software) can be fully compromised by APTs in a matter of hours, and can be useful for years. Mid-range sites can take a few weeks, but then they're completely compromised. Airgaps make the attacks significantly more expensive, but a proper airgap is exceedingly rare. Physical presences require ongoing support, and take months or years to groom.