Iran-backed hackers breached a US federal agency that failed to patch year-old bug