The hacks, which took advantage of vulnerable internet-facing web applications, date to at least May 2021, according to findings made public by cybersecurity firm Mandiant.