Attackers combined remote access, credential theft and data collection tools to quietly gather and remove sensitive ...