Compromised IoT devices were used in a yearslong campaign against key sectors and federal agencies.