Cargo theft malware actor spent a month inside a decoy network before researchers pulled the plug