Global cyber security vendor Sophos claims a cryptominer known as MrbMiner that infects database servers is being managed from a small software company in Iran.