According to researchers from Cisco, evidence shows the intruders were in a few government systems late last summer, but didn't deposit their malicious wiper on the systems until recently.