Malware variants targeting operational tech systems rare – but 2 found last year