Microsoft server hack likely single actor, thousands of firms now vulnerable