Investigators found the malware, dubbed Firestarter, on a federal agency's network in a campaign dating back to at least September 2025.