“GRU officers scanned state and local websites for vulnerabilities.”