Ex-head of National Cyber Security Centre says group has ‘two-year history of attacking organisations across the world’