> First seen at the end of November, the second variant had larger files and contained a complex JSON configuration

Even the hackers are going enterprise-y. I wonder if they too are forced to use Jira...