A threat actor started using the Shai-Hulud worm in attacks only days after the malware’s source code was released.