US security officials say attackers based in Iran scanned state websites for vulnerabilities, successfully breaching at least one, in intimidation campaign aimed at thousands