Mysterious safety-tampering malware infects a second critical infrastructure site