This is the first incident where a threat actor from the country appears to be laying the groundwork for disruptive attacks in the future, researchers say.