Attacks targeting the now-patched bug have been going on since at least April 2023, security vendor says.