The first hacking unit, dubbed APT29, sent out a barrage of emails containing a “malicious link to over 1,000 recipients, including multiple U.S. government victims.” Once someone clicked on the link, the hackers were in the system.