Top federal cyber unit gives agencies one week to identify and patch software compromised in a serious nation-state hack.