The group is likely nation-state-backed and is mounting an ongoing spy campaign using custom malware and stealthy tactics.
Source: threatpost.com