BladeHawk attackers have been targeting the Kurdish ethnic group for more than a year through a Facebook-based spyware campaign that disguises backdoors in legitimate Android apps, researchers have found.