Are we SURE this is State-level stuff? If I were running a State-level outfit, I'd accept nothing less than nuke-proof malware that can pwn machines at the HARDWARE level, beyond any hope of recovery. And we KNOW that's possible due to such things already being seen in the wild.