Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

1. Executive summary

Russian threat actors assessed by Proofpoint as the group Laundry Bear (aka Void Blizzard, TA488, CL-STA-1114, UNK_PitStop) are actively exploiting CVE-2026-42897 (CVSS 8.1, High), a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA), to deliver a JavaScript backdoor called OWAReaper. The campaign began on 22 July 2026 and targets U.S. and European government entities plus the telecommunications, financial, hospitality, and aerospace sectors. The exploit is a "half-click" vector — viewing the email in a vulnerable OWA client is sufficient to trigger compromise, with no user click, URL, or attachment required. OWAReaper establishes persistent mailbox access that survives credential rotation by rewriting email content on the Exchange server and creating unique session keys. Attribution to Laundry Bear is single-sourced (Proofpoint); the actor has no MITRE ATT&CK profile in the verified reference data and must be treated as unconfirmed.

2. Regulatory framing

No NIS2 or UK NIS article is specifically engaged beyond generic incident-response obligations, as no supply-chain-specific or third-party-specific trigger fact is present in this item.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by The Hacker News and BleepingComputer, both citing Proofpoint)

1. Initial access vector — phishing email delivery. The threat actor sends emails from adversary-controlled Proton Mail accounts and previously compromised email addresses. Emails contain vague, generic lures mimicking informational content (supply chain analyses, research updates, tourism/gas market metrics). No URLs or attachments are included. The goal is to maximise open rates without arousing suspicion.
2. Exploit trigger — "half-click" XSS via CVE-2026-42897. Opening or viewing the email in a vulnerable OWA client is sufficient to fire the exploit. No user interaction beyond rendering the message is required. The exploit uses an onload= event handler in the message body HTML to parse the remaining message content, assemble a Base64 fragment, and execute it as encoded JavaScript. The initial exploit trigger and payload blobs are embedded in social media icons within the HTML message body. Next-stage payload data is stored after # symbols, which the browser stops at when parsing images from Base64 — effectively hiding the payload from casual inspection.
3. Payload execution — OWAReaper implant. The JavaScript implant executes within the OWA reading pane. OWAReaper is described as the most sophisticated backdoor delivered via half-click exploits and is an evolution of the previously observed ZimReaper (which targeted Zimbra via CVE-2025-66376). The two implants share significant source code and behavioural overlaps.
4. Persistence — server-side email rewrite + session key. OWAReaper uses Outlook APIs to rewrite the malicious email on the Exchange server, removing the exploit content from the message. This destroys forensic evidence of the initial vector on the server. The implant creates a session key unique to the target victim. It gathers the target's email address, username, and Outlook settings.
5. Anti-analysis / UX manipulation. The malware disables OWA pop-ups and the right-click context menu during execution, preventing the user from inspecting or interrupting implant activity.
6. Persistent mailbox access. The combination of server-side rewrite, unique session key, and Outlook API abuse enables the actor to maintain access to the victim's mailbox even after credential rotation — the core objective of the campaign per the source reporting.

Capability summary

Attribution caveat: Attribution to Laundry Bear / Void Blizzard / TA488 is single-sourced to Proofpoint. The verified reference data contains no MITRE ATT&CK profile for "Russian threat actors" or any of the listed aliases. Treat the attribution as unconfirmed. The actor's prior exploitation of CVE-2025-66376 in Zimbra (patched approximately November 2025) is corroborated across both source articles.

CVE discrepancy note: None. Both sources agree on CVE-2026-42897, CVSS 8.1, XSS classification. Microsoft flagged in-the-wild exploitation as far back as May 2026.

4. Mitigation & containment

P1 — within 24 hours

• Patch OWA / Exchange. Apply the vendor fix for CVE-2026-42897 to all internet-facing Exchange servers running OWA. Microsoft has flagged this as exploited in the wild since May 2026. If a patch is not yet available for your Exchange version, contact Microsoft Support for an interim mitigation or guidance.
• Hunt for OWAReaper. Search Exchange mailbox logs and IIS logs for evidence of server-side email rewrites that removed content from messages received since 22 July 2026. Look for messages from Proton Mail addresses (@proton.me, @protonmail.com) or from known compromised internal accounts that were sent to OWA users.
• Block Proton Mail at the mail gateway if not business-required. The threat actor uses adversary-controlled Proton Mail accounts for initial delivery. If Proton Mail has no legitimate business use, block or quarantine at the perimeter.

P2 — within 72 hours

• Review OWA session activity. Examine Exchange/OWA session logs for anomalous session keys, unexpected API calls from the OWA reading pane, or sessions that persist after credential resets. OWAReaper's persistence survives credential rotation — a password reset alone does not evict the implant.
• Audit mailbox rules and forwarding. Check for any inbox rules, forwarding rules, or delegate permissions created since 22 July 2026 that the user did not author. OWAReaper uses Outlook APIs; rule creation is a likely persistence adjunct.
• Force full OWA session termination. For any user whose mailbox is suspected compromised, terminate all active OWA sessions (not just password reset) via Exchange admin tools to invalidate the session key. Verify the implant is not re-establishing after session reset.

P3 — within 7 days

• Disable OWA for non-essential users if risk warrants. If patching is delayed or the threat is assessed as high-risk to your organisation, consider disabling OWA access for users who do not require webmail, forcing them through Outlook desktop or mobile clients that are not vulnerable to this XSS vector.
• Update mail gateway filtering. Implement content filtering for HTML emails containing onload= event handlers in message bodies and Base64-encoded data in <img> tags or social media icon elements. These are the specific artefacts of the exploit payload delivery mechanism.
• Review DORA Art. 24 testing scope. Ensure OWA is explicitly included in digital operational resilience testing and that known-exploited vulnerability checks cover CVE-2026-42897 and CVE-2025-66376 (Zimbra).

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, file hashes, email addresses) are present in the provided source material. The sources describe observable behaviours and exploit artefacts but do not publish specific IOCs.

Behavioural indicators

6. Detection

rule OWAReaper_Exploit_Payload_Markers {
    meta:
        author = "Adverse Trace"
        date = "2026-07-30"
        reference = "https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html"
        description = "Detects HTML email artefacts associated with CVE-2026-42897 OWA half-click exploit payload delivery"
    strings:
        $onload_handler = "onload=" ascii nocase
        $base64_fragment = "base64," ascii nocase
        $hash_separator = "#" ascii
        $social_icon = "social" ascii nocase
        $img_tag = "<img" ascii nocase
    condition:
        $onload_handler and $base64_fragment and $hash_separator and ($social_icon or $img_tag)
}

title: Suspicious OWA Email with onload Handler and Base64 Payload in Image Tags
id: 7a3c1f2e-2026-4d8a-b901-owaexploit001
status: experimental
description: >
    Detects inbound HTML emails containing onload event handlers in img/social media
    icon tags with Base64-encoded data and hash-separated payload fragments,
    consistent with CVE-2026-42897 OWA half-click exploit delivery.
author: Adverse Trace
date: 2026/07/30
references:

    - https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html
    - https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/
logsource:
    product: email
    service: inbound
detection:
    selection_html:
        email_body|contains:

            - "onload="
            - "base64,"
            - "<img"
    selection_payload_marker:
        email_body|contains:

            - "#"
    filter_legitimate:
        email_body|contains:

            - "social"
    condition: selection_html and selection_payload_marker
falsepositives:

    - Legitimate HTML newsletters using onload handlers and Base64 images (rare in enterprise mail)
level: high

title: OWA Session Persistence After Credential Reset
id: 8b4d2a3f-2026-5e9c-a102-owapersist002
status: experimental
description: >
    Detects OWA session activity continuing after a user's credentials were reset,
    consistent with OWAReaper session key persistence that survives credential rotation.
author: Adverse Trace
date: 2026/07/30
references:

    - https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html
logsource:
    product: microsoft
    service: exchange
detection:
    selection_credential_reset:
        event_id|contains:

            - "credential_reset"
            - "password_change"
            - "4724"
    selection_owa_session:
        event_id|contains:

            - "owa_session"
            - "owa_login"
    timeframe: 24h
    condition: selection_credential_reset followed by selection_owa_session
falsepositives:

    - User re-authenticating to OWA after password reset with new credentials (verify source IP and user agent consistency)
level: medium

7. Sources

• The Hacker News — "Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation" — https://thehackernews.com/2026/07/russian-hackers-exploit-microsoft-owa.html — 2026-07-30
• BleepingComputer — "Russian hackers exploit Exchange OWA zero-day for long-term mailbox access" — https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ — 2026-07-30 (referenced for corroboration; full text not in corpus)

8. Adverse Trace position

Severity: High. CVE-2026-42897 (CVSS 8.1) is actively exploited in the wild per Microsoft, with a campaign targeting financial services among other sectors since 22 July 2026. The "half-click" delivery model — requiring only that the victim open the email in OWA — eliminates the user-interaction barrier that most phishing relies on, making this a high-probability compromise vector for any unpatched OWA deployment. The OWAReaper implant's ability to persist through credential rotation is operationally significant: standard incident response (password reset) is insufficient to evict the actor. EMEA financial services clients with internet-facing OWA should treat patching as immediate and hunt for OWAReaper artefacts in Exchange/IIS logs. Attribution to Laundry Bear / Void Blizzard / TA488 is single-sourced to Proofpoint and unconfirmed against MITRE ATT&CK; we will update this advisory if additional attribution corroboration or atomic IOCs emerge. We are monitoring for the vendor patch advisory and any CISA KEV addition.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.