Researchers discover APT attackers that rummage dark web, GitHub and hidden criminal forums to patch together a high-impact APT.