ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities