Chinese gang used ArcGIS as a backdoor for a year – and no one noticed