A federal appearance in Boston has turned a cross-border cyberespionage case into a reminder that stolen identities, not flashy malware, are often the real engine of modern intrusions.