Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

1. Executive summary

The Russian state-sponsored threat group Laundry Bear (aka Void Blizzard, TA488, CL-STA-1114) is actively exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA), to deliver a backdoor tracked as OWAReaper. The vulnerability stems from improper HTML sanitization in the OWA message body, enabling a "half-click" exploit requiring only that the user open a crafted email — no links clicked or attachments opened. OWAReaper establishes long-term mailbox persistence that survives credential rotation and clean-image restoration by abusing Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and grant itself Owner-level folder permissions. Attribution to Laundry Bear / Void Blizzard is unconfirmed: neither actor has a MITRE ATT&CK profile in the verified reference data. EMEA financial services organisations running on-premises Exchange OWA are directly in the targeting scope, alongside government, telecommunications, hospitality, and aerospace sectors.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Proofpoint and BleepingComputer)

1. Infrastructure preparation (March 2026): Laundry Bear / TA488 created attack infrastructure for the OWAReaper campaign approximately two months before Microsoft's May 14, 2026 advisory for CVE-2026-42897, indicating pre-disclosure exploitation planning.
2. Targeted email delivery (from July 22, 2026): The threat actor sent spear-phishing emails with banal subject lines and lures — supply-chain analyses, research updates, performance indicators for tourism and gas markets. The emails contained no suspicious URLs or attachments, reducing the likelihood of user reporting.
3. Half-click exploit trigger: When the target user opens the crafted email in OWA, CVE-2026-42897 (XSS via improper HTML sanitisation in the message body) executes arbitrary JavaScript in the browser context. No click on a link or opening of an attachment is required — merely opening the email in the OWA reading pane is sufficient.
4. Payload delivery: The malicious emails contained a JavaScript loader and Base64-encoded payload blobs embedded in social media icon URLs after the # character (fragment identifier), which the browser does not transmit to the server.
5. OWAReaper execution and self-concealment: The backdoor executes entirely within the OWA reading pane. Upon execution, it: - Uses Outlook APIs to rewrite the email on the Exchange server, removing the exploit content (destroying the forensic trail in the mailbox). - Disables OWA pop-ups and right-click functionality while running.
6. Credential and data collection: OWAReaper collects the compromised account's email address, username, and Outlook settings. It attempts credential theft by creating invisible elements in the Document Object Model (DOM) that the browser's autofill mechanism populates automatically.
7. Long-term persistence via OAuth token theft: OWAReaper checks for installed Outlook add-ins that have ReadWriteMailbox permissions and uses them to steal OAuth tokens through the GetClientAccessToken operation request.
8. Owner-level permission grant: Using the stolen token, OWAReaper calls UpdateFolder to grant itself Owner-level permissions to the 'Default' user (a low-permission account). This persistence mechanism survives credential rotation and clean-image restoration because the access is anchored in Exchange mailbox folder permissions, not in the endpoint or the user's current credentials.

Technical relationship to prior campaign: OWAReaper is an evolution of the ZimReaper malware previously delivered via CVE-2025-66376 (a now-patched XSS vulnerability in Zimbra Collaboration Suite webmail). Both campaigns use the same "half-click" XSS methodology. The Zimbra campaign has been active since July 2025, per a joint advisory from NSA, FBI, CISA, and agencies from the Netherlands, UK, Australia, Canada, and others.

Attribution caveat: Laundry Bear / Void Blizzard / TA488 / CL-STA-1114 attribution is unconfirmed — neither named actor has a MITRE ATT&CK profile in the verified reference data. The attribution rests on Proofpoint's tracking and the multi-agency joint advisory. Single-sourced elements (Proofpoint's technical analysis of OWAReaper internals) should be verified before enforcement actions.

4. Mitigation & containment

P1 — Within 24 hours

• Patch Exchange Server: Apply the Microsoft patch for CVE-2026-42897 immediately. Microsoft released the fix on May 14, 2026; any unpatched on-premises Exchange Server with OWA exposed is actively exploitable. Verify patch deployment across all Exchange nodes.
• Block OWA external access (interim): If patching cannot be completed within 24h, restrict OWA access at the reverse proxy / firewall layer to internal IP ranges only or require VPN for external access. This eliminates the remote attack surface for the half-click exploit.
• Audit mailbox folder permissions: Search for anomalous Owner-level permissions granted to the 'Default' user or unexpected accounts on user mailbox folders. Use Exchange PowerShell: powershell Get-MailboxFolderPermission -Identity "<user>:\Inbox" | Where-Object {$_.User -eq "Default" -and $_.AccessRights -match "Owner"} Repeat for \Calendar, \Sent Items, and root folder (:\).

P2 — Within 72 hours

• Audit Outlook add-ins with ReadWriteMailbox scope: Enumerate all installed add-ins across the Exchange organisation and identify those with ReadWriteMailbox permissions. Revoke or restrict any unnecessary add-ins. This eliminates the OAuth token theft vector used for persistence.
• Hunt for OWAReaper artefacts: Review OWA/IIS logs for patterns consistent with the exploit — specifically, look for GetClientAccessToken and UpdateFolder API calls originating from OWA sessions that accessed emails with embedded Base64 payloads in social media icon URLs (fragment identifiers after #).
• Review authentication logs: Search for OAuth token usage patterns from OWA sessions that do not correlate with legitimate add-in activity. Flag any token issuance via GetClientAccessToken for add-ins the user did not intentionally install.
• Inspect mailbox content for rewritten emails: OWAReaper rewrites the exploit email on the Exchange server to remove malicious content. Look for emails in user mailboxes that were modified or that show signs of content removal (empty body, missing HTML structure) shortly after being opened.

P3 — Within 7 days

• Implement OWA hardening: Disable or restrict Outlook add-in installation for non-administrative users via Exchange / Microsoft 365 policies. Enforce least-privilege on add-in permission scopes.
• Deploy HTML sanitisation controls: If using a third-party email security gateway in front of Exchange, ensure it strips or sanitises inline JavaScript and Base64-encoded content in HTML email bodies, particularly in fragment identifiers.
• Conduct retrospective detection: Search historical IIS/OWA logs from March 2026 onward for indicators of pre-patch exploitation, given that the threat actor built infrastructure two months before the Microsoft advisory.
• Validate Zimbra exposure: If the organisation also runs Zimbra Collaboration Suite, verify patching for CVE-2025-66376 and hunt for ZimReaper artefacts, as the same threat group has been exploiting that vulnerability since July 2025.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, email addresses) are available in the source material. The sources describe observable behaviours and technical artefacts of the exploit and backdoor but do not publish specific IOCs.

Behavioural indicators

6. Detection

rule OWAReaper_Backdoor_Artefacts {
  meta:
    author = "Adverse Trace"
    date = "2026-07-30"
    reference = "https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/"
    description = "Detects OWAReaper backdoor artefacts: API calls, DOM manipulation, and payload embedding patterns"
  strings:
    $api_token = "GetClientAccessToken"
    $api_folder = "UpdateFolder"
    $perm_scope = "ReadWriteMailbox"
    $perm_target = "Owner"
    $user_default = "Default"
    $dom_invisible = "invisible"
  condition:
    3 of them
}

title: Exchange OWA OAuth Token Theft via GetClientAccessToken for Add-in Persistence
id: 7a3c1f2e-4b5d-4a8e-9c1f-6d2e3a4b5c6d
status: experimental
description: Detects OWAReaper persistence mechanism — GetClientAccessToken API call followed by UpdateFolder granting Owner permissions to Default user
author: Adverse Trace
date: 2026/07/30
references:

  - https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
logsource:
  product: microsoft
  service: exchange
detection:
  selection_token:
    event.action|contains: "GetClientAccessToken"
  selection_folder:
    event.action|contains: "UpdateFolder"
  selection_permission:
    event.action|contains: "Owner"
  selection_user:
    event.action|contains: "Default"
  condition: selection_token and selection_folder and selection_permission and selection_user
falsepositives:

  - Legitimate administrative changes to mailbox folder permissions involving the Default user
  - Authorised add-in token requests via GetClientAccessToken for business workflows
level: high

7. Sources

• BleepingComputer — "Russian hackers exploit Exchange OWA zero-day for long-term mailbox access" — https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ — 2026-07-29
• The Hacker News — "Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation" — https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html — 2026-07
• The Record (Recorded Future) — "Laundry Bear's webmail hackers had more in store after February, report says" — https://therecord.media/russia-hackers-outlook-webmail-malware — 2026
• Help Net Security — "Russian hackers exploit unpatched Zimbra servers to steal emails" — https://www.helpnetsecurity.com/2026/07/24/laundry-bear-zimbra-vulnerability-cve-2025-66376/ — 2026-07-24
• BleepingComputer — "Russian hackers exploit Zimbra zero-click flaw for email theft" — https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-zimbra-zero-click-flaw-for-email-theft/ — 2026
• BleepingComputer — "Microsoft patches Exchange Server zero-day exploited in attacks" — https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-exchange-server-zero-day-exploited-in-attacks/ — 2026

8. Adverse Trace position

This is a high-severity active exploitation campaign targeting on-premises Exchange OWA deployments with a zero-day that was exploited in the wild before vendor disclosure. The OWAReaper backdoor's persistence mechanism — surviving credential rotation and clean-image restoration via OAuth token theft and mailbox folder permission grants — represents a significant escalation in webmail-focused tradecraft and makes incident response and recovery substantially harder than typical email compromise scenarios. EMEA financial services clients running on-premises Exchange with OWA exposed to the internet should treat patching for CVE-2026-42897 as an emergency action and immediately audit for the persistence indicators described above. Attribution to Laundry Bear / Void Blizzard is unconfirmed (no MITRE ATT&CK profiles in verified reference data); the technical detail rests primarily on Proofpoint's reporting — single-sourced for OWAReaper internals; verify before enforcement. We will monitor for published IOCs, additional sector-specific targeting, and any Microsoft guidance on detecting the OAuth token abuse persistence mechanism.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.