The group infected more than 1,000 organizations in a relentless supply-chain attack campaign.