A security analyst is investigating a breach where attackers gained access to the organization's research and development servers containing proprietary manufacturing designs for military equipment. The attackers spent three months conducting reconnaissance, used custom malware with advanced anti-forensics capabilities, and exfiltrated data without causing any system disruptions or requesting ransom. Which threat actor is MOST likely responsible for this attack?