Chinese APT group found stealing data for three years through old Windows flaw