Full research report

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

Laundry Bear has conducted two successive webmail half-click XSS campaigns in under a year — first against Zimbra via CVE-2025-66376, then against Exchange OWA via CVE-2026-42897 — demonstrating a consistent and maturing tradecraft of targeting sanitisation failures in email rendering engines. The group's development of OWAReaper infrastructure in March 2026, two months before Microsoft's advisory, indicates zero-day possession and deliberate pre-positioning, suggesting the vulnerability was either discovered independently or acquired before public disclosure. OWAReaper's most operationally significant advance over ZimReaper is its Exchange API-based persistence: granting Owner-level permissions to the 'Default' user alias across all mail folders gives the attacker a durable mailbox foothold that survives both credential rotation and full endpoint reimaging — standard incident-response steps will not remediate this without explicit permission auditing. Using GitHub's public Commit Search API as a C2 channel is a notable detection-evasion choice, as the traffic is indistinguishable from routine developer activity and encrypted at the payload level, making network-based detection impractical without endpoint-level artefact hunting.

What happened

The Russian state-sponsored group Laundry Bear (also tracked as Void Blizzard and TA488) is actively exploiting CVE-2026-42897, an XSS flaw in Microsoft Exchange OWA, to deliver a novel JavaScript backdoor called OWAReaper. Proofpoint, which discovered the campaign around 22 July 2026, established that the group built its attack infrastructure in March 2026 — two months before Microsoft's 14 May 2026 advisory confirming zero-day exploitation. The campaign is an evolution of an earlier operation against Zimbra email servers using CVE-2025-66376 and ZimReaper malware, which ran as a zero-day from at least July 2025 until a November 2025 patch. OWAReaper extends ZimReaper's credential-theft logic with server-side persistence mechanisms that survive credential rotation and endpoint reimaging.

Affected scope

On-premises Microsoft Exchange Server only (Exchange Online is not affected): Exchange Server 2016 CU23 before build 15.01.2507.069; Exchange Server 2019 CU14 before 15.02.1544.041; Exchange Server 2019 CU15 before 15.02.1748.046; Exchange Server Subscription Edition RTM before 15.02.2562.043. Targeted sectors include US and European government entities, telecommunications, financial services, hospitality, and aerospace. The prior Zimbra campaign additionally hit defence, education, energy, law enforcement, media, NGOs, and technology organisations including Ukrainian and NATO-aligned entities.

Technical assessment

CVE-2026-42897 (CWE-79) arises from improper HTML sanitisation in the OWA message-body renderer, allowing JavaScript embedded in a specially crafted email to execute via an onload event handler the moment a recipient opens the message — no link click or attachment required, a technique Proofpoint terms a 'half-click exploit'. The payload is a JavaScript loader with Base64-encoded blobs hidden in social media icon URLs. OWAReaper runs entirely within the OWA browser reading pane, rewrites the email on the Exchange server to remove the exploit, and simultaneously disables OWA pop-ups and right-click functionality during execution. Persistence is achieved through four layered mechanisms: encrypting itself into browser localStorage under keys mimicking legitimate OWA settings; embedding hidden iframes in IndexedDB-cached messages for reactivation; stealing OAuth tokens via installed Outlook add-ins with ReadWriteMailbox permissions; and using Exchange's UpdateFolder API to grant Owner-level permissions to the 'Default' user alias across every mail folder, maintaining mailbox access independently of victim credentials. C2 operates over two parallel channels: querying GitHub's Commit Search API every 24 hours for AES-encrypted commands embedded in commit messages, and polling IndexedDB for inbound emails matching command patterns. Exfiltration uses AES-CTR-encrypted HTTPS requests proxied through public CDNs (Weserv.nl, WordPress, Slack image services) with DNS tunnelling over Base32-encoded subdomains as a fallback.

Recommended defensive actions

  1. Patch on-premises Microsoft Exchange Server to the June 2026 Patch Tuesday builds immediately: Exchange 2016 CU23 to ≥ 15.01.2507.069; Exchange 2019 CU14 to ≥ 15.02.1544.041; Exchange 2019 CU15 to ≥ 15.02.1748.046; Exchange SE RTM to ≥ 15.02.2562.043.
  2. Audit Exchange mailbox folder permissions for any Owner-level grants to the 'Default' user alias, which is the primary OWAReaper persistence indicator that survives credential rotation.
  3. Hunt for OWAReaper artifacts: inspect browser localStorage for anomalous OWA settings keys, examine IndexedDB for hidden iframes in cached messages, and query Exchange server logs for GetClientAccessToken and UpdateFolder API calls outside normal administrative patterns.
  4. Block outbound connections to known Laundry Bear C2 infrastructure at the network boundary: asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com.
  5. Revoke and rotate OAuth tokens and application passcodes for all accounts that accessed OWA during the exposure window; remove Outlook add-ins with ReadWriteMailbox permissions that cannot be verified as legitimate.
  6. Update Zimbra Collaboration Suite to the latest available version if deployed, revoke application passcodes named 'ZimbraWeb', and check for ZimReaper IOCs published in the joint NSA/FBI/CISA advisory.

Uncertainties and evidence gaps

  • The full scope of successful OWAReaper compromises has not been publicly confirmed; Proofpoint's sector-level targeting list may not reflect all affected organisations.
  • Whether Laundry Bear exploited CVE-2026-42897 before March 2026 (when C2 infrastructure was first observed) remains unknown; the March date is derived from infrastructure telemetry rather than confirmed victim intrusion records.
  • GitHub accounts used to host AES-encrypted commands in commit messages have not been publicly named, limiting proactive threat hunting via that C2 channel.
  • No formal government attribution statement specifically covering the July 2026 OWAReaper campaign has been published; the Yutek-NN link identified by US prosecutors relates to earlier Laundry Bear activity.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated external attacker sends a specially crafted email to a targeted mailbox; exploitation is triggered solely by the recipient opening the message in the OWA web interface — no link click or attachment interaction required
ComponentOutlook Web Access (OWA) HTML message-body renderer in on-premises Microsoft Exchange Server
MechanismImproper neutralisation of HTML input (CWE-79) allows attacker-controlled JavaScript to execute via the onload event handler when OWA renders the malicious message in the reading pane
ImpactAttacker gains persistent read/write access to the victim's mailbox, exfiltrates credentials, email content and OAuth tokens, and retains mailbox access through credential rotation and full endpoint reimaging via Exchange API permission manipulation
DetectionAnomalous UpdateFolder and GetClientAccessToken API calls in Exchange audit logs; unexpected Owner-level permissions on mail folders granted to the 'Default' user alias; outbound DNS queries or HTTPS traffic to asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com
MitigationApply the June 2026 Patch Tuesday security update for the relevant Exchange Server version; audit and remove unexpected 'Default' user Owner mailbox permissions; revoke suspicious OAuth tokens and Outlook add-ins with ReadWriteMailbox permissions
Exploitation status

CVE-2026-42897 is confirmed actively exploited in the wild in an ongoing July 2026 campaign by Laundry Bear delivering OWAReaper; CVE-2025-66376 (Zimbra) was previously exploited as a zero-day from July 2025 and remains a risk on unpatched Zimbra deployments, per CISA KEV and a joint NSA/FBI/CISA advisory.

Research process

Investigation began with the BleepingComputer article and CISA KEV records from the source material as leads. The Proofpoint primary report was confirmed accessible and provided authoritative technical detail on OWAReaper, C2 infrastructure, and attribution. CVE specifics were verified against the NVD entry. Three independent sources — The Record, Help Net Security, and Security Affairs — corroborated the threat actor identity, the prior Zimbra campaign, and the government advisory context. Confidence is high based on convergent findings across the original researcher (Proofpoint), a standards body (NVD), and multiple specialist security outlets.

  1. Does the BleepingComputer source article exist and what does it report?
    Fetched the BleepingComputer article on Russian hackers exploiting Exchange OWA
    bleepingcomputer.com ↗

    Article confirmed as published 29 July 2026. Reports Laundry Bear exploiting CVE-2026-42897 in Exchange OWA to deploy OWAReaper; describes half-click XSS mechanism, persistence via Exchange API permission grants to 'Default' user, and C2 over GitHub commit messages. Cites Proofpoint as primary source.

    why Establishes the event's core claims and identifies Proofpoint as the authoritative technical source requiring independent verification.

  2. What do independent sources report about CVE-2026-42897 and the TA488/OWAReaper campaign?
    Searched for CVE-2026-42897 and Laundry Bear / OWAReaper coverage across multiple outlets

    Multiple independent outlets confirm: CVE-2026-42897 is a high-severity XSS in Exchange OWA, CVSS 8.1 (Microsoft), added to CISA KEV 15 May 2026, permanently patched June 2026. TA488 campaign was observed from 22 July 2026 by Proofpoint.

    why Search results reveal corroborating coverage across Dark Reading, SOC Prime, Hard2Bit, The Record and others, confirming the story is independently reported and not solely a BleepingComputer item.

  3. What does Proofpoint's primary technical report say about OWAReaper's capabilities and attribution?
    Fetched Proofpoint blog post on TA488 OWA campaign
    proofpoint.com ↗

    Confirmed: OWAReaper stores itself in browser localStorage under OWA settings keys, embeds hidden iframes in IndexedDB, grants Owner-level permissions to 'Default' user via Exchange UpdateFolder API, and uses GitHub Commit Search API and email polling for C2. Exfiltration via AES-CTR HTTPS proxied through CDNs and DNS tunnelling fallback. C2 domains first observed March–April 2025/2026. Infrastructure predates the May 2026 Microsoft advisory by two months.

    why Proofpoint is the originating researcher; their report is the most technically authoritative source and was verified as accessible, confirming all material claims in the BleepingComputer article and adding C2 domain IOCs.

  4. What are the authoritative CVE details for CVE-2026-42897 including affected versions and CVSS?
    Fetched NVD vulnerability detail page for CVE-2026-42897
    nvd.nist.gov ↗

    NVD confirms CWE-79, CVSS 6.1 (NIST) and 8.1 (Microsoft), four specific Exchange build version thresholds for patching, Exchange Online not affected, and CISA KEV listing added 15 May 2026 with federal due date 29 May 2026.

    why NVD provides the standards-body CVE record that defenders require for patch prioritisation; the CVSS score discrepancy (6.1 vs 8.1) reflects differing scope assumptions between NIST and Microsoft and is material context.

  5. Does The Record provide independent corroboration and additional attribution detail?
    Fetched The Record article on Laundry Bear OWA malware campaign
    therecord.media ↗

    Independently confirms the campaign targeting, dates, and malware name. Adds that US prosecutors linked Laundry Bear to Russian IT firm Yutek-NN, and Dutch authorities were involved in the initial identification. Notes no observed group activity between February and 22 July 2026.

    why Specialist security outlet providing independent verification and attribution context that strengthens the Russian state-sponsorship assessment with a named commercial entity.

  6. What are the details of the prior Zimbra campaign (CVE-2025-66376/ZimReaper) to establish the broader pattern?
    Fetched Help Net Security article on Laundry Bear Zimbra exploitation
    helpnetsecurity.com ↗

    CVE-2025-66376 is an XSS flaw in Zimbra patched November 2025, exploited as a zero-day from July 2025. ZimReaper stole 90 days of email, 2FA tokens, passwords and application passcodes. A joint advisory was issued by NSA, FBI, CISA and approximately 14 international partners.

    why Establishes the prior campaign as confirmed and independently verified, supporting Proofpoint's claim that OWAReaper is an evolution of ZimReaper and that Laundry Bear has sustained offensive development capability.

  7. Does Security Affairs confirm the joint government advisory scope and provide additional CVE-2025-66376 technical detail?
    Fetched Security Affairs article on US agency warnings for the Zimbra campaign
    securityaffairs.com ↗

    Confirms NSA, FBI, CISA joint advisory with international partners. Identifies CSS @import directive as the CVE-2025-66376 exploitation technique. Confirms attacker focus on unpatched Zimbra systems remains active.

    why Second independent source confirming the joint advisory and the specific exploitation technique for the prior campaign, providing cross-validation for ZimReaper campaign claims.

Named in this story
ActorsLaundry BearVoid BlizzardTA488
MalwareOWAReaperZimReaper
TargetsUS and European government entitiesTelecommunications sectorFinancial sectorHospitality sectorAerospace sectorUkrainian entities (prior Zimbra campaign)
Related CVEs CVE-2025-66376CVE-2026-42897

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (3 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 56 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok9 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1656 records Primary evidence2 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
NVDcve ok900 records Primary evidence1 matched items Supplied a vendor or government advisory opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
FIRST EPSSepss ok Context2 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok667 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok14 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation4
CVE-2026-42897 CISA KEV Microsoft Microsoft · added 2026-05-15 CISA catalog ↗
CVE-2025-66376 CISA KEV Synacor Zimbra Collaboration Suite (ZCS) · added 2026-03-18 CISA catalog ↗
CVE-2025-66376 EPSS 21.6% 97th percentile exploitation probability
CVE-2026-42897 EPSS 5.6% 92th percentile exploitation probability
Vendor & gov advisories2
CVE-2026-42897 – NVD Vulnerability Detail: Microsoft Exchange Server OWA XSS nvd.nist.gov ↗

Authoritative CVE record confirming CWE-79, CVSS 8.1 (Microsoft)/6.1 (NIST), affected Exchange build numbers, and CISA KEV listing added 15 May 2026

Microsoft Security Response Center – CVE-2026-42897 msrc.microsoft.com ↗

Vendor advisory page confirmed to exist (referenced in NVD entry); Microsoft confirmed active exploitation on 14 May 2026 and shipped permanent patch in June 2026 Patch Tuesday

Analysis & research5
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit | Proofpoint proofpoint.com ↗

Primary technical source: details OWAReaper persistence mechanisms, C2 over GitHub Commit Search API, DNS-tunnelling exfiltration, and attribution evidence linking campaign to ZimReaper

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access | BleepingComputer bleepingcomputer.com ↗

Detailed summary of Proofpoint findings with campaign timeline and lure-topic context

Laundry Bear's webmail hackers had more in store after February | The Record therecord.media ↗

Independent corroboration linking Laundry Bear to Russian firm Yutek-NN and confirming gap in observed activity between February and 22 July 2026

Russian hackers exploit unpatched Zimbra servers to steal emails | Help Net Security helpnetsecurity.com ↗

Confirms CVE-2025-66376 zero-day exploitation from July 2025, ZimReaper data-theft capabilities, and joint NSA/FBI/CISA international advisory

US Agencies Warn of Laundry Bear Campaign Targeting Unpatched Zimbra Servers | Security Affairs securityaffairs.com ↗

Second independent source confirming joint advisory scope and CVE-2025-66376 CSS @import exploitation technique