State-backed attackers and commercial surveillance vendors repeatedly use the same exploits Threat Analysis Group (TAG)