Russian cyber snoops linked to massive credential-stealing campaign