The GRIDTIDE backdoor concealed its traffic within routine spreadsheet activity for years before Google shut down the operation last week.