Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall 0-Days