The malicious code, which masquerades as ransomware, appears to come from a hacking group with ties to Iran.