It’s going to take months to kick elite hackers widely believed to be Russian out of the U.S. government networks they have been quietly rifling through since as far back as March in Washington’s worst cyberespionage failure on record.

Experts say there simply are not enough skilled threat-hunting teams to identify all the government and private-sector systems that may have been hacked. FireEye, the cybersecurity company that discovered the worst-ever intrusion into U.S. agencies and was among the victims, has already tallied dozens of casualties. It’s racing to identify more.

“We have a serious problem. We don’t know what networks they are in, how deep they are, what access they have, what tools they left,” said Bruce Schneier, a prominent security expert and Harvard fellow…

The only way to be sure a network is clean is “to burn it down to the ground and rebuild it,” Schneier said.