Two Chinese-nexus groups have been exploiting a newly discovered flaw to establish persistence and launch backdoors.