Clarissa Hana
A sophisticated Russian state-sponsored hacking group, identified as Laundry Bear and also known by the moniker Void Blizzard, has been observed actively exploiting a critical vulnerability within Microsoft Exchange’s Outlook Web Access (OWA) platform. This exploit, which leverages a cross-site scripting (XSS) flaw designated as CVE-2026-42897, allows the attackers to deliver a potent backdoor malware named OWAReaper, granting them persistent and deep access to victim mailboxes. The discovery was made by email security firm Proofpoint, which has been tracking this activity for approximately one week and has identified targets spanning various critical sectors, including U.S. and European government entities, as well as companies in the telecommunications, financial, hospitality, and aerospace industries.
The exploitation mechanism hinges on a "half-click" technique, a term coined by Proofpoint researchers to describe vulnerabilities that are triggered simply by the act of opening a specially crafted email within the OWA interface. This particular XSS vulnerability, CVE-2026-42897, allows attackers to inject and execute arbitrary JavaScript code within the user’s browser context. When a targeted individual opens a malicious email in OWA, the embedded JavaScript is unleashed, initiating the compromise without requiring the user to click on any suspicious links or download any attachments. This stealthy approach significantly lowers the barrier to entry for the attackers and increases the likelihood of a successful breach.
This is not the first time Laundry Bear has targeted webmail platforms with similar tactics. The group previously demonstrated proficiency in exploiting zero-day vulnerabilities, notably a flaw in Zimbra email servers (CVE-2025-66376). That prior campaign involved a "zero-click" exploit that delivered malware dubbed ZimReaper. ZimReaper was designed to exfiltrate sensitive email communications, two-factor authentication (2FA) codes, application passcodes, and stored passwords. The successful deployment of ZimReaper underscored Laundry Bear’s adeptness at leveraging webmail vulnerabilities for espionage and data theft, setting a precedent for their current campaign against Microsoft Exchange.
A Pattern of Sophistication: Evolution of Tradecraft
Proofpoint’s latest report details how the OWAReaper campaign represents a notable "improvement in the group’s tradecraft and capability." This assessment is supported by the timeline of the exploitation. Microsoft issued an advisory regarding CVE-2026-42897 on May 14th, warning of its exploitation as a zero-day. However, Proofpoint’s analysis indicates that Laundry Bear, tracked by Proofpoint as TA488, had already established the necessary attack infrastructure for the OWAReaper campaign by March, a full two months before Microsoft’s public disclosure. This proactive approach suggests advanced threat intelligence gathering and a high degree of operational readiness.
The vulnerability itself stems from an "improper HTML sanitization" issue within the OWA server. This means the server fails to adequately clean or neutralize potentially malicious HTML code embedded within incoming emails. Attackers can exploit this by crafting messages that, when rendered by OWA, trigger the execution of JavaScript. Proofpoint researchers observed that Laundry Bear meticulously designed their attack vectors to be as inconspicuous as possible. The subject lines and content of the lure emails were intentionally banal, often referencing topics of direct interest to the targeted organizations, such as "supply-chain analyses," "research updates," and market performance indicators for sectors like tourism and gas. The aim was to encourage recipients to open and quickly skim the message, dismissing it as routine or even junk mail, without raising suspicion. The absence of overtly suspicious URLs or attachments further contributes to the deceptive nature of these attacks.
The technical mechanism involves embedding malicious code within the HTML and JavaScript of the messages. Proofpoint’s analysis revealed that the exploit code typically included a JavaScript loader and Base64-encoded payload blobs. These were often cleverly concealed within social media icon URLs, following a ‘#’ character, making them difficult to detect through superficial examination.
OWAReaper: A New Breed of Backdoor
The payload delivered by this exploit is the OWAReaper backdoor, which Proofpoint describes as "the most sophisticated backdoor delivered via half-click exploits" they have encountered. OWAReaper is not merely a data exfiltration tool; it is designed for deep system infiltration and persistent access. Researchers note that OWAReaper represents an evolution of the ZimReaper malware, inheriting and enhancing its capabilities.
A key characteristic of OWAReaper is its execution environment. It operates entirely within the OWA reading pane. Upon activation, it leverages Outlook APIs to not only execute its malicious functions but also to subtly modify the compromised email on the Exchange server, effectively erasing the exploit code from the message itself. Concurrently, it takes steps to disable certain user interface elements within OWA, such as pop-ups and the right-click context menu, to prevent users from noticing any unusual activity while the malware operates in the background.
The immediate objectives of OWAReaper include gathering crucial information about the compromised account, such as the email address, username, and configured Outlook settings. More critically, it attempts to steal access credentials. It achieves this by dynamically creating invisible elements within the Document Object Model (DOM) of the OWA interface and waiting for the browser’s auto-fill features to populate these fields with saved credentials. This method bypasses traditional password entry, making it a highly effective credential harvesting technique.
Unprecedented Persistence: Surviving System Restorations and Credential Changes
Perhaps the most alarming aspect of OWAReaper is its ability to establish long-term persistence, even in the face of significant security countermeasures. Proofpoint researchers have detailed how TA488 (Laundry Bear/Void Blizzard) can maintain access to a target’s mailbox even after the affected system has been restored from a clean backup or the compromised user’s credentials have been reset. This level of persistence is achieved through a multi-pronged approach.
Firstly, OWAReaper identifies and exploits installed Outlook add-ins that possess ReadWriteMailbox permissions. By leveraging these add-ins, the malware can steal OAuth tokens through a specific Microsoft Exchange Web Services operation called GetClientAccessToken. Once these tokens are acquired, OWAReaper utilizes the UpdateFolder operation to grant itself "Owner-level permissions" to a highly privileged, low-permission alias present in all Microsoft Exchange tenants, known as the ‘Default’ user. This grants the attackers broad access to every mail folder within the compromised mailbox.
The implications of this persistence mechanism are profound. Since mailbox permissions are configured server-side, any remediation efforts focused solely on the client machine, such as reinstalling the operating system or rotating user passwords, will not revoke the attackers’ access. They have effectively embedded themselves at the server level, allowing them to access the mailbox from any authenticated account within the organization, not just the initially compromised one.
OWAReaper implements a secondary persistence mechanism that involves enabling caching and injecting a malicious iframe into the HTML of emails stored within OWA’s offline IndexedDB. This malicious iframe is designed to execute every time the victim opens a compromised email that has been cached locally. This means that even if the original exploit is removed, the malware can re-activate itself through cached data, creating a persistent threat vector.
Dual-Layered Command and Control and Data Exfiltration
The malware’s resilience is further enhanced by its sophisticated command and control (C2) infrastructure. OWAReaper supports two distinct C2 mechanisms, providing redundancy and adaptability. One method leverages GitHub commit messages as a communication channel. The malware periodically queries GitHub’s Commit Search API, looking for encrypted messages formatted in a specific way and containing the target’s email address. This obscure method of communication is designed to blend in with legitimate network traffic and evade detection by traditional network monitoring tools.
The second C2 channel involves parsing emails delivered directly to the target’s mailbox. OWAReaper scans the IndexedDB for message bodies that adhere to a particular structure: target_email_addressspaceBase64text. This allows attackers to send instructions disguised as seemingly ordinary emails.
Laundry Bear also employs a robust data exfiltration strategy, utilizing multiple methods to ensure sensitive information reaches their servers. The primary method involves using HTTPS connections, with data encrypted using AES-CTR encryption for URI paths. This traffic is often proxied through legitimate content delivery network (CDN) domains, further obscuring its malicious origin. If this primary method encounters issues, a fallback mechanism directly sends data to the attacker’s server, as defined within the malware’s outbound network session initialization functions. As a final contingency, a DNS exfiltration fallback is in place. In this scenario, data is encrypted, encoded using the Base32 method, and then transmitted within DNS packets. This multi-layered approach to C2 and exfiltration highlights the advanced planning and technical capabilities of the Laundry Bear group.
Proofpoint’s attribution of this OWAReaper campaign to TA488 is based on a convergence of evidence, including the behavioral similarities with the previously observed ZimReaper activity and the consistent use of "half-click" XSS exploits targeting webmail platforms for espionage. The security firm has released a limited set of indicators of compromise (IoCs), which include the domains utilized in the attacks and the specific HTML message body containing the CVE-2026-42897 exploit and the OWAReaper payload. These IoCs are crucial for organizations to identify and fortify their defenses against this evolving threat.
The implications of this persistent mailbox access are severe, extending beyond simple data theft. With owner-level permissions, attackers can monitor all communications, manipulate or delete sensitive emails, impersonate users, and potentially gain access to further internal systems through credentials or information found within the compromised mailbox. The ability to bypass credential resets and system restorations means that organizations must adopt more robust detection and response strategies, focusing on server-side configurations and advanced threat hunting techniques to effectively neutralize such sophisticated, persistent threats.
