A cybersecurity firm said it detected the virus during a threat-hunting exercise, though it called it the “work of an inventive but relatively inexperienced developer” that has been mostly confined.