Experts still trying to assess scope of months-long operation that slipped code into software update used on servers across the globe and in all 5 branches of US military