Any charges would mark an escalation in the US response to what it has said is a growing number of attacks by foreign hackers on US businesses and government