Security analysts spot “first publicly documented case” of popular open source tool being used to stage a network intrusion.