For years, the GRU was snooping in critical infrastructure firms by abusing misconfigurations and zero-days, Amazon says.