Security researchers have lately observed new builds and incremental changes to the malware, indicating that someone with access to its source code is experimenting with it.