that's a brutal hack. so they hacked the hosting update server, made it monitor incoming IPs, and then selectively uploaded a compromised backdoor update based on IP only to certain computers so it would go undetected longer?

it's awful, but technically impressive that someone could remotely hack the server like that and set up such a complex system to target IPs... unless it was a state actor that compelled the server company to provide local access, in which case it's less impressive.