The government-backed hackers exploited fake friends and family with spear-phishing lures, according to research published Wednesday.