Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns