Attackers not only steal credentials but also can maintain long-term, persistent access to corporate networks through the global campaign.