The dozen allegedly used spear phishing emails and malware and hacked voter data on a state website.