Once thought to be dormant, the China-aligned group has also been observed using the privately-sold ShadowPad backdoor for the first time