The investigation is focused on whether the malware confirmed this time is found on the same home subscriber server (HSS) as the code discovered during the initial hacking or on separate equipment.