The prolific APT group compromised state government networks by exploiting the Log4j flaw and a vulnerability in an animal health emergency reporting system.