By law, the government can't monitor domestic Internet traffic. Hackers suspected of being Russian exploited this blind spot by disguising their origins and working through unwitting U.S. companies.