“The attacker has issued several new TLS certificates using Let’s Encrypt service which were used to hijack encrypted STARTTLS connections on port 5222 using transparent MiTM proxy. The attack was discovered due to expiration of one of the MiTM certificates, which haven’t been reissued.”
Someone sat inside Hetzner’s and Linode’s networks in Germany and read jabber.ru traffic for at least 90 days, maybe six months. Nobody hacked the servers. The redirect lived in the hosting providers’ own network, which points to a lawful intercept order. The rogue Let’s Encrypt certificates sat in the public certificate transparency log the whole time. The wiretappers got caught because they forgot to renew a cert.