A Chinese APT is going where most APTs don't: deep into the cloud, compromising supply chains and deploying uncommon malware.