Attackers planted web shells through Collabora's Built-in CODE app while its document server was down; versions before 26.4.303 are affected.
Researchers said the BRICKSTORM campaign stood out because of its “sophistication, evasion of advanced enterprise security ...