Hackers Exploit Exchange OWA Zero‑Day

Overview

The Russian state‑sponsored group Laundry Bear (Void Blizzard, TA488) has been observed exploiting a Microsoft Exchange Outlook Web Access (OWA) zero‑day vulnerability to deliver a sophisticated backdoor dubbed OWAReaper. According to Proofpoint, the campaign targets government agencies in the U.S. and Europe, as well as organizations in telecommunications, finance, hospitality, and aerospace.

Vulnerability Details

• CVE‑2026‑42897: A cross‑site scripting (XSS) flaw in OWA.
• Attack vector: Malicious emails crafted to exploit improper HTML sanitization.
• Trigger: Victims only need to open the email — no clicks or attachments required (“half‑click exploit”).
• Payload delivery: JavaScript loader with Base64‑encoded blobs hidden in social media icon URLs.

OWAReaper Backdoor Capabilities

Proofpoint researchers describe OWAReaper as “the most sophisticated backdoor delivered via half‑click exploits.”

• Execution: Runs entirely in the OWA reading pane.
• Persistence mechanisms:
  • Uses Outlook APIs to rewrite emails and remove exploit traces.
  • Steals OAuth tokens via Outlook add‑ins with ReadWriteMailbox permissions.
  • Grants itself Owner‑level permissions to the “Default” user across all mail folders.
  • Injects malicious iframes into cached OWA messages (IndexedDB).
• Data theft: Collects email addresses, usernames, Outlook settings, and attempts to steal auto‑filled credentials.
• C2 channels:
  • GitHub commit messages (queried every 24 hours).
  • Specially formatted emails in IndexedDB.
• Exfiltration methods:
  • HTTPS with AES‑CTR encrypted URIs proxied through CDN domains.
  • Direct server connections.
  • DNS exfiltration fallback using Base32 encoding.

Long‑Term Persistence

OWAReaper’s design ensures mailbox access even if:

• Credentials are rotated.
• Systems are reimaged.
• Accounts are restored.

Because mailbox permissions are configured server‑side, attackers retain access across authenticated accounts within the organization.

Defensive Guidance

Organizations should:

• Apply Microsoft patches immediately.
• Audit mailbox permissions for unauthorized “Default” user ownership.
• Monitor GitHub commit queries and suspicious IndexedDB activity.
• Block suspicious CDN domains linked to AES‑CTR exfiltration.
• Review audit logs for anomalies tied to application tokens.

Expert in the Cloud Insight

The OWAReaper campaign underscores how webmail platforms are prime espionage targets. By exploiting subtle flaws in HTML sanitization, Laundry Bear bypasses traditional defenses and achieves long‑term mailbox persistence. For defenders, the lesson is clear: patch quickly, monitor mailbox permissions, and treat half‑click exploits as high‑priority threats