I've mentioned it in real life with a couple of you, but if you haven't got the chance to check out Kaspersky's write up of the ProjectSauron discovery, it's pretty friggin amazing! From an admin's perspective, these are some very skilled, serious hackers and they were able to hide away for years without being found.
https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf
