Linguistic analysis of the malware’s ransom note suggests origins of its writers, US security firm says