The attackers appear to be using stolen administrative local and domain credentials, and placing sophisticated malware implants on critical systems, according to the NCCIC. "While NCCIC continues ...