# Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox Access

> Russia-aligned threat actor TA488 (aka Void Blizzard, Laundry Bear) is actively exploiting CVE-2026-42897, a cross-site scripting zero-day in Microsoft Exchange Outlook Web Access, using half-click email exploits to deploy a JavaScript browser-based implant called OWAReaper for persistent mailbox access. The campaign, running since approximately July 22, 2026, targets US and European government entities as well as the telecommunications, financial services, hospitality, and aerospace sectors.

- **Published:** 2026-07-29T00:00:00Z
- **Last reviewed:** 2026-08-02T08:33:44.328Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1763
- **ID:** TL-2026-1763
- **Severity:** CRITICAL (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** TA488 (Russia)
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-42897, CVE-2025-66376

## Description

CVE-2026-42897 is a cross-site scripting (CWE-79) vulnerability in the web interface of on-premises Microsoft Exchange Server, caused by improper HTML sanitization of message bodies in Outlook Web Access (OWA). Attackers embed a JavaScript loader and Base64-encoded payload fragments inside social-media-icon URLs, stashed after the '#' character so the fragments are not stripped by server-side sanitization. When a victim merely opens the crafted email in OWA (a 'half-click' exploit requiring no click or attachment), the loader reassembles and executes the payload entirely inside the OWA reading-pane DOM, with no attachment, macro, or host filesystem footprint. Microsoft rates the flaw 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N); it affects only on-premises Exchange Server 2016, 2019, and Subscription Edition — Exchange Online is not affected. Microsoft confirmed active, targeted exploitation on May 14, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 15, 2026 (due date May 29, 2026), and a permanent fix (KB5094139) shipped June 9, 2026 as part of June Patch Tuesday.

OWAReaper, the implant delivered through the exploit, is described by Proofpoint researcher Greg Lesnewich as 'one of the coolest implants we've ever examined' and the most sophisticated backdoor yet observed delivered via a half-click webmail exploit. After execution it immediately strips the exploit content from the source email server-side to erase the infection artifact, disables OWA pop-ups and right-click handlers to hinder inspection, and harvests the victim's email address, username, and Outlook settings. It steals credentials by intercepting browser autofill data and inserting invisible DOM elements into the OWA page to capture typed input, then exfiltrates data over HTTPS using AES-CTR-encrypted URI paths proxied through legitimate image CDNs (images.weserv.nl, i3.wp.com, slack-imgs.com) to blend with normal traffic, with a DNS Base32 label-tunneling fallback channel over attacker-controlled domains when HTTPS egress is blocked.

OWAReaper's persistence is unusually durable for a browser-based implant with no disk presence. It extracts OAuth access tokens from any Outlook add-ins the victim has installed that hold ReadWriteMailbox scope, then abuses the Exchange Web Services UpdateFolder operation to grant the 'Default' user Owner-level permissions on every mail folder — a server-side grant that survives password resets, credential rotation, and even full device re-imaging, because the backdoor lives in the mailbox's permission model rather than the endpoint. As a secondary re-infection path, it enables OWA's offline caching mode and injects a hidden malicious iframe into the cached message HTML stored in the browser's owa_offline_db IndexedDB store and PageDataPayload.OwaUserDefaultSettings localStorage key; the implant silently reactivates whenever the victim's browser replays that cached, poisoned message during normal sync.

For command and control, OWAReaper polls the GitHub Commit Search API roughly every 24 hours, looking for specially crafted commit messages containing the target's email address — a 'dead drop resolver' pattern that hides C2 tasking inside legitimate developer-platform traffic. As a secondary channel it polls the victim's own inbox every 5 minutes for inbound emails formatted as '{target_email_address} {Base64text}', supporting a 'domn' command for C2 domain/infrastructure rotation and a 'cmnd' command for arbitrary code execution, all wrapped in AES-CTR encryption using hardcoded and per-session keys. Observed exfiltration/staging artifact names include ews_extensions_debug.json, msanalytics.json, cmnd_[HASH]_[FILENAME], and poison_wizard_error_dom.html. Proofpoint (Suricata rules 2071330 for the CVE-2026-42897 exploit and 2071331-2071335 for OWAReaper beacon/exfiltration traffic) observed campaign infrastructure (asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com) stood up around March 2026, roughly two months ahead of the vulnerability's May 2026 public disclosure, with active exploitation beginning July 22, 2026 against US and European government, telecommunications, financial-services, hospitality, and aerospace targets. Lures use deliberately banal subject lines (e.g. 'Capacity Build-Out: Pipelines, Pricing, and Interconnection Metrics', 'Semiconductor Supply Chain Indicators: Capacity, Packaging, and Pricing', 'Public Health Surveillance: Wastewater, Flu, AMR') mimicking routine analytical reporting, designed to be dismissed as low-priority rather than reported.

TA488 is assessed with high confidence to be a Russia-aligned espionage actor, tracked by Microsoft as Void Blizzard and by Dutch authorities as Laundry Bear, active since at least April 2024 against NATO member states, Ukraine, and government/defense/scientific/telecommunications/financial/hospitality/aerospace/nuclear-sector targets; U.S. prosecutors have linked the group to the Russian IT firm Yutek-NN, which has ties to the FSB. OWAReaper is a direct evolution of ZimReaper, the group's prior implant delivered via a half-click XSS zero-day in Zimbra Collaboration Suite (CVE-2025-66376), which a joint NSA/FBI/CISA and international-partner advisory disclosed had been exploited since at least July 2025 to steal victims' last 90 days of email, credentials, the organization's email directory, 2FA tokens, and newly created application passcodes, using Docker-based C2 infrastructure ('Flowerbed') on rented cloud servers concealed behind Mullvad VPN.

## MITRE ATT&CK

- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1550 Use Alternate Authentication Material
- T1056 Input Capture
- T1528 Steal Application Access Token
- T1087 Account Discovery
- T1114 Email Collection
- T1213 Data from Information Repositories
- T1102 Web Service
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1567 Exfiltration Over Web Service
- T1585 Establish Accounts
- T1608 Stage Capabilities
- T1189 Drive-by Compromise
- T1176 Software Extensions
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1111 Multi-Factor Authentication Interception
- T1589.002 Gather Victim Identity Information: Email Addresses
- T1090.002 Proxy: External Proxy
- T1518 Software Discovery
- T1005 Data from Local System

## Sources

- [Russian hackers exploit Exchange OWA zero-day for long-term mailbox access](https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/)
- [Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit](https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit)
- [NVD - CVE-2026-42897](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-42897)
- [Microsoft Security Response Center - CVE-2026-42897](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42897)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-42897](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42897)
- [Laundry Bear's webmail hackers had more in store after February, report says](https://therecord.media/russia-hackers-outlook-webmail-malware)
- [Russian TA488 Returns With Persistent Outlook Web Access Attack](https://www.infosecurity-magazine.com/news/ta488-outlook-half-click-owareaper/)
- [Laundry Bear hackers exploit unpatched Zimbra servers to steal emails (CVE-2025-66376)](https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/)
- [CVE-2026-42897 Exchange OWA Flaw Patched: KB5094139 Now Available](https://windowsnews.ai/article/cve-2026-42897-exchange-owa-flaw-patched-kb5094139-now-available-for-subscription-edition-esu-requir.425134)
- [Exchange Server OWA Zero-Day CVE-2026-42897 Exploited With No Permanent Patch and New Mitigation Gaps](https://www.techtimes.com/articles/316860/20260519/exchange-server-owa-zero-day-cve-2026-42897-exploited-no-permanent-patch-new-mitigation-gaps.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1763