Threat group builds custom malware to attack industrial systems