The group compromised at least 10 regional organizations, including two state-owned entities, and deployed a new backdoor.