Do you allow permissive outgoing Internet traffic from your servers? To domains recently created? This malware is for you.