Cleo has released patches for the exploited vulnerability and security firms have detailed the malware delivered in attacks.