Researchers observed downloads of installers for the APTs flagship backdoor, MgBot, when users at a Chinese NGO were updating legitimate applications.