Threat reportVulnerabilityTL-2026-1763
Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox Access
Russian TA488 (Void Blizzard / Laundry Bear) Exploits (TL-2026-1763), also tracked as OWAReaper Campaign, is a critical-severity software vulnerability scored CVSS 8.1, first published 2026-07-29 and last reviewed 2026-08-02. It is attributed to TA488 (Russia) with high confidence, affects Microsoft Exchange Server 2016 CU23, references 2 CVEs (CVE-2026-42897, CVE-2025-66376), maps to 37 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 45 indicators of compromise.
- CVSS
- 8.1/10Critical
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 37MITRE ATT&CK
- Actors
- 1TA488
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 45Indicators of compromise
Key facts for TL-2026-1763
- Threat ID
- TL-2026-1763
- Also known as
- OWAReaper Campaign
- Severity
- CRITICAL
- CVSS
- 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- TA488
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- government administration, telecoms, financial services, hospitality, aerospace
- Target regions
- united states of america, Europe
- Detection rules
- 9
- Indicators of compromise
- 45
- Updates
- 2026-08-02 · 4 updates · revalidated 4× · latest source
Malware and tooling in Russian TA488 (Void Blizzard / Laundry Bear) Exploits
Malware and tooling: OWAReaper, ZimReaper, Mullvad VPN
How Russian TA488 (Void Blizzard / Laundry Bear) Exploits works
Russia-aligned threat actor TA488 (aka Void Blizzard, Laundry Bear) is actively exploiting CVE-2026-42897, a cross-site scripting zero-day in Microsoft Exchange Outlook Web Access, using half-click email exploits to deploy a JavaScript browser-based implant called OWAReaper for persistent mailbox access. The campaign, running since approximately July 22, 2026, targets US and European government entities as well as the telecommunications, financial services, hospitality, and aerospace sectors.
CVE-2026-42897 is a cross-site scripting (CWE-79) vulnerability in the web interface of on-premises Microsoft Exchange Server, caused by improper HTML sanitization of message bodies in Outlook Web Access (OWA). Attackers embed a JavaScript loader and Base64-encoded payload fragments inside social-media-icon URLs, stashed after the '#' character so the fragments are not stripped by server-side sanitization. When a victim merely opens the crafted email in OWA (a 'half-click' exploit requiring no click or attachment), the loader reassembles and executes the payload entirely inside the OWA reading-pane DOM, with no attachment, macro, or host filesystem footprint. Microsoft rates the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N); it affects only on-premises Exchange Server 2016, 2019, and Subscription Edition — Exchange Online is not affected. Microsoft confirmed active, targeted exploitation on May 14, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 15, 2026 (due date May 29, 2026), and a permanent fix (KB5094139) shipped June 9, 2026 as part of June Patch Tuesday.
OWAReaper, the implant delivered through the exploit, is described by Proofpoint researcher Greg Lesnewich as 'one of the coolest implants we've ever examined' and the most sophisticated backdoor yet observed delivered via a half-click webmail exploit. After execution it immediately strips the exploit content from the source email server-side to erase the infection artifact, disables OWA pop-ups and right-click handlers to hinder inspection, and harvests the victim's email address, username, and Outlook settings. It steals credentials by intercepting browser autofill data and inserting invisible DOM elements into the OWA page to capture typed input, then exfiltrates data over HTTPS using AES-CTR-encrypted URI paths proxied through legitimate image CDNs (images.weserv.nl, i3.wp.com, slack-imgs.com) to blend with normal traffic, with a DNS Base32 label-tunneling fallback channel over attacker-controlled domains when HTTPS egress is blocked.
OWAReaper's persistence is unusually durable for a browser-based implant with no disk presence. It extracts OAuth access tokens from any Outlook add-ins the victim has installed that hold ReadWriteMailbox scope, then abuses the Exchange Web Services UpdateFolder operation to grant the 'Default' user Owner-level permissions on every mail folder — a server-side grant that survives password resets, credential rotation, and even full device re-imaging, because the backdoor lives in the mailbox's permission model rather than the endpoint. As a secondary re-infection path, it enables OWA's offline caching mode and injects a hidden malicious iframe into the cached message HTML stored in the browser's owa_offline_db IndexedDB store and PageDataPayload.OwaUserDefaultSettings localStorage key; the implant silently reactivates whenever the victim's browser replays that cached, poisoned message during normal sync.
For command and control, OWAReaper polls the GitHub Commit Search API roughly every 24 hours, looking for specially crafted commit messages containing the target's email address — a 'dead drop resolver' pattern that hides C2 tasking inside legitimate developer-platform traffic. As a secondary channel it polls the victim's own inbox every 5 minutes for inbound emails formatted as '{target_email_address} {Base64text}', supporting a 'domn' command for C2 domain/infrastructure rotation and a 'cmnd' command for arbitrary code execution, all wrapped in AES-CTR encryption using hardcoded and per-session keys. Observed exfiltration/staging artifact names include ews_extensions_debug.json, msanalytics.json, cmnd_[HASH]_[FILENAME], and poison_wizard_error_dom.html. Proofpoint (Suricata rules 2071330 for the CVE-2026-42897 exploit and 2071331-2071335 for OWAReaper beacon/exfiltration traffic) observed campaign infrastructure (asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com) stood up around March 2026, roughly two months ahead of the vulnerability's May 2026 public disclosure, with active exploitation beginning July 22, 2026 against US and European government, telecommunications, financial-services, hospitality, and aerospace targets. Lures use deliberately banal subject lines (e.g. 'Capacity Build-Out: Pipelines, Pricing, and Interconnection Metrics', 'Semiconductor Supply Chain Indicators: Capacity, Packaging, and Pricing', 'Public Health Surveillance: Wastewater, Flu, AMR') mimicking routine analytical reporting, designed to be dismissed as low-priority rather than reported.
TA488 is assessed with high confidence to be a Russia-aligned espionage actor, tracked by Microsoft as Void Blizzard and by Dutch authorities as Laundry Bear, active since at least April 2024 against NATO member states, Ukraine, and government/defense/scientific/telecommunications/financial/hospitality/aerospace/nuclear-sector targets; U.S. prosecutors have linked the group to the Russian IT firm Yutek-NN, which has ties to the FSB. OWAReaper is a direct evolution of ZimReaper, the group's prior implant delivered via a half-click XSS zero-day in Zimbra Collaboration Suite (CVE-2025-66376), which a joint NSA/FBI/CISA and international-partner advisory disclosed had been exploited since at least July 2025 to steal victims' last 90 days of email, credentials, the organization's email directory, 2FA tokens, and newly created application passcodes, using Docker-based C2 infrastructure ('Flowerbed') on rented cloud servers concealed behind Mullvad VPN.
MITRE ATT&CK techniques used in TL-2026-1763
Collection
T1005 Data from Local System; T1114 Email Collection; T1213 Data from Information Repositories
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Credential Access
T1056 Input Capture; T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Command and Control
T1071 Application Layer Protocol; T1090.002 Proxy: External Proxy; T1102 Web Service; T1132 Data Encoding; T1573 Encrypted Channel
Discovery
T1087 Account Discovery; T1518 Software Discovery
Persistence
T1098 Account Manipulation; T1176 Software Extensions
Initial Access
T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1566 Phishing
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
T1589.002 Gather Victim Identity Information: Email Addresses; T1591 Gather Victim Org Information
Affected products and versions in Russian TA488 (Void Blizzard / Laundry Bear) Exploits
- Microsoft — Exchange Server 2016 CU23
Vulnerable versions: < 15.01.2507.069
Fixed in: 15.01.2507.069 - Microsoft — Exchange Server 2019 CU14
Vulnerable versions: < 15.02.1544.041
Fixed in: 15.02.1544.041 - Microsoft — Exchange Server 2019 CU15
Vulnerable versions: < 15.02.1748.046
Fixed in: 15.02.1748.046 - Microsoft — Exchange Server Subscription Edition (RTM)
Vulnerable versions: < 15.02.2562.043
Fixed in: 15.02.2562.043 (KB5094139)
Remediation for Russian TA488 (Void Blizzard / Laundry Bear) Exploits
Patches
- Microsoft KB5094139 — permanent fix for CVE-2026-42897, released June 9, 2026 as part of June Patch Tuesday for Exchange Server Subscription Edition RTM SU7
- Extended Security Updates (ESU) Period 2 eligibility required for unsupported Exchange Server 2016/2019 deployments to receive the fix
Immediate actions
- Apply Microsoft's permanent patch KB5094139 (Exchange Subscription Edition RTM SU7, June 9 2026) for CVE-2026-42897 on all on-premises Exchange 2016/2019/Subscription Edition servers
- Audit and revoke Exchange Web Services (EWS) OAuth access tokens issued to Outlook add-ins holding ReadWriteMailbox permission
- Remove any anomalous 'Default' user Owner-level permission grants on mailbox folders created via UpdateFolder operations
- Clear the OWA owa_offline_db IndexedDB store and the PageDataPayload.OwaUserDefaultSettings localStorage key on potentially affected endpoints to remove the offline-cache re-infection vector
- Block outbound network access to known campaign domains (asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com) and monitor for anomalous traffic patterns to images.weserv.nl, i3.wp.com, and slack-imgs.com
Workarounds
- Apply Microsoft's interim mitigation guidance issued ahead of the permanent patch (tracked publicly as Mitigation M2) pending full deployment of KB5094139
- Where feasible, restrict or disable OWA light/reading-pane auto-preview to reduce half-click exposure until patched
Longer-term hardening
- Deploy Suricata detection content (rules 2071330-2071335) for CVE-2026-42897 exploitation and OWAReaper beacon/exfiltration traffic
- Disable or restrict OWA offline/cached mode where not operationally required to eliminate the IndexedDB iframe re-infection path
- Enforce conditional access and periodic re-validation for EWS/Graph API tokens issued to third-party Outlook add-ins
- Monitor Exchange unified audit logs for anomalous mailbox folder permission changes (UpdateFolder grants of Owner rights)
- Migrate legacy on-premises Exchange 2016/2019 deployments to Exchange Subscription Edition or Exchange Online, which is not affected by CVE-2026-42897
- Apply the same hardening and monitoring approach to other on-premises webmail platforms (e.g. Zimbra) given TA488's demonstrated pattern of reusing half-click XSS tradecraft across products
CVEs associated with Russian TA488 (Void Blizzard / Laundry Bear) Exploits
Weaknesses (CWE) in Russian TA488 (Void Blizzard / Laundry Bear) Exploits
Timeline of Russian TA488 (Void Blizzard / Laundry Bear) Exploits
- Void Blizzard / Laundry Bear (TA488) assessed active since at least April 2024, conducting cyberespionage intrusions against NATO member states and Ukraine.
- Laundry Bear (TA488 / Void Blizzard) is first publicly exposed following an intrusion against Dutch police, per Proofpoint's reporting.
- Proofpoint identifies OWAReaper C2 domains asecdns.com and acocdn.com as first observed as early as March 2025, indicating reuse of older infrastructure in the 2026 OWA campaign.
- DNS-tunneling C2 domain dnsrecursive.eu is identified as first observed in April 2025, predating the March 2026 OWA-campaign infrastructure buildout.
- TA488 begins exploiting CVE-2025-66376, a half-click XSS zero-day in Zimbra Collaboration Suite, to deliver the ZimReaper implant and steal email, credentials, and 2FA tokens; activity runs undetected for months.
- TA488 adds an XOR obfuscation layer to the ZimReaper payload used in the ongoing Zimbra/CVE-2025-66376 campaign.
- CVE-2025-66376 (Zimbra) is patched roughly four months after TA488 began exploiting it as a zero-day, ending that wave of ZimReaper activity.
- Observable TA488 activity ceases after the Zimbra campaign's disclosure, beginning a roughly five-month quiet period before the OWAReaper/CVE-2026-42897 campaign resumes.
- TA488 stands up attack infrastructure (C2/exfiltration domains including asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com) for the forthcoming OWAReaper campaign, roughly two months before CVE-2026-42897 is publicly disclosed.
- Additional OWAReaper C2 domains (dnsrecursive[.]eu, tdndns[.]com) registered, expanding the campaign's infrastructure roughly one month after the initial March 2026 setup.
- Microsoft confirms CVE-2026-42897, an XSS zero-day in on-premises Exchange Server OWA, is being actively exploited in targeted attacks and publishes a security advisory.
- CISA adds CVE-2026-42897 to its Known Exploited Vulnerabilities catalog with a remediation due date of May 29, 2026.
- CISA BOD 22-01 remediation due date for CVE-2026-42897 for federal civilian executive branch agencies, per the CISA KEV catalog listing added 2026-05-15.
- Microsoft ships the permanent fix for CVE-2026-42897 via KB5094139 as part of June 2026 Patch Tuesday, for Exchange Server Subscription Edition RTM SU7.
- TA488 begins actively exploiting CVE-2026-42897 in the wild, delivering the OWAReaper JavaScript implant via half-click emails against US and European government, telecom, financial, hospitality, and aerospace targets.
- NSA, FBI, CISA, and international partners issue a joint advisory on the related Laundry Bear Zimbra vulnerability (CVE-2025-66376) abuse.
- BleepingComputer, The Record, and Infosecurity Magazine publish coverage of the OWAReaper campaign, amplifying detection and remediation guidance to defenders.
- Proofpoint publishes 'Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit,' detailing OWAReaper's exploit chain, persistence, and C2 mechanisms.
Update history for TL-2026-1763
- 2026-08-02 — TA488 Exploits Outlook Web Access "Half-Click" XSS Flaw (CVE-2026-42897) to Deploy OWAReaper Backdoor: What changed No escalation — severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), CVSS (8.1), and attribution confidence (HIGH) are unchanged and consistent with the existing record. New indicators (8) 2 new artifact IOCs (owa_off
- 2026-08-02 — Laundry Bear (Void Blizzard) Deploys OWAReaper Backdoor via Outlook Web Access Half-Click Exploit (CVE-2026-42897): What changed No field escalations — severity, exploitability, status, and attribution confidence are unchanged. Adds two newly documented MITRE techniques (Software Discovery T1518, Data from Local System T1005). New indicators (3) Two new
- 2026-08-02 — TA488 (Void Blizzard) Exploits Outlook Web Access Zero-Day CVE-2026-42897 with OWAReaper Implant: What changed No severity/exploitability/status change — remains CRITICAL / ACTIVE / ACTIVE, CVSS 8.1, corroborated by an independent report. New indicators (2) 2 new behavioral indicators: the specific EWS 'GetClientAccessToken' API call ab
- 2026-07-30 — Russian Laundry Bear (TA488) Exploits Microsoft OWA XSS Zero-Day (CVE-2026-42897) to Deploy OWAReaper Backdoor for Persistent Mailbox Access: What changed No escalation to severity, exploitability, status, or CVSS: this report lists severity as HIGH vs. the existing record's CRITICAL, which is a downgrade and is not applied (existing CRITICAL/ACTIVE/8.1 retained). Adds actor-alia
Sources cited for Russian TA488 (Void Blizzard / Laundry Bear) Exploits
- Russian hackers exploit Exchange OWA zero-day for long-term mailbox access
- Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
- NVD - CVE-2026-42897
- Microsoft Security Response Center - CVE-2026-42897
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-42897
- Laundry Bear's webmail hackers had more in store after February, report says
- Russian TA488 Returns With Persistent Outlook Web Access Attack
- Laundry Bear hackers exploit unpatched Zimbra servers to steal emails (CVE-2025-66376)
- CVE-2026-42897 Exchange OWA Flaw Patched: KB5094139 Now Available
- Exchange Server OWA Zero-Day CVE-2026-42897 Exploited With No Permanent Patch and New Mitigation Gaps
Detection coverage for TL-2026-1763
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1763 across Splunk SPL, Microsoft KQL and Sigma, covering 45 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.