The state-sponsored hackers deployed custom tools and stayed dormant in the compromised environments for months.