The well hidden secret among large tech companies is that persistent threats are quite often discovered after ~6 months active presence going unnoticed. Some persist for years.

Yes, this is very common especially when you're living off the land. You take over the one unmonitored host and then you use the internal tools as if you were a normal employee.

"the quieter you are, the more you will hear"