Tech giant says cell conducted 'extensive password spraying' against 250 Office users, compromising fewer than 20; targets include maritime shipping firms doing business in Mideast