The malware, launched against a Saudi Arabia-based oil refinery in 2017, also scanned and probed at least 20 electric facilities in the U.S. in 2019.