Unit 42 traced a two-year intrusion that turned a single management box into keys for hundreds of networks.