IC Technology & Cyber — 2026-07-31

Russian Laundry Bear Group Deploys New Microsoft Exchange Zero-Day That Triggers on Email Open

BLUFOWAReaper's server-side persistence model renders standard credential rotation and endpoint remediation ineffective, leaving compromised Exchange tenants exposed until administrators audit every mailbox permission grant.

Proofpoint reported that Russia-aligned TA488 (Void Blizzard, Laundry Bear) began exploiting CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access, on July 22, one day before Proofpoint's joint release with NSA on the group's prior activity 1. The campaign targets US and European government entities and organizations in telecommunications, finance, hospitality, and aerospace, using lure subject lines such as "Global Gas Markets" and "Semiconductor Supply Chain Indicators" 1. Opening the email in OWA triggers arbitrary JavaScript that installs an implant Proofpoint calls OWAReaper, which grants itself owner-level mailbox permissions on the server side and maintains browser-side persistence via localStorage manipulation and IndexedDB cache poisoning, together surviving credential rotation and full device re-imaging 123. Proofpoint assesses OWAReaper as an evolution of the ZimReaper payload used in TA488's earlier Zimbra campaign, sharing code for harvesting autofill credentials and error-handling routines but confined to the OWA reading pane rather than ZimReaper's mass mailbox exfiltration, and receiving commands via GitHub Commit Search API queries every 24 hours and polled operator emails every five minutes 14. Infrastructure tied to the campaign dates to March 2026, two months before Microsoft's out-of-band patch 15.

Analysis
Server-side persistence surviving credential rotation and re-imaging forces administrators toward mailbox-permissions review, manual audits of folder-level Owner grants across tenants, rather than standard credential resets. The shift from Zimbra-era mass exfiltration to selective, add-in-mediated token theft prioritizes stealth and longevity over collection volume, though the broad targeting across telecommunications, finance, hospitality, and aerospace could reflect opportunistic reach as easily as deliberate collection expansion. Dual tasking channels through GitHub commit search and inbound email give the group resilience that ordinary domain takedowns will not disrupt. Infrastructure dating to March 2026, two months before Microsoft's patch, points to undisclosed prior access against government and critical-sector targets predating public awareness of the flaw. Proofpoint is the sole primary source; other outlets amplify without independent verification.

5 sources

Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit - Proofpoint
Russian hackers exploit Exchange OWA zero-day for long-term mailbox access - BleepingComputer
Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation - The Hacker News
Russian spies take their half-click email attack from Zimbra to Outlook - The Register
Laundry Bear new Microsoft Exchange attack triggers on email open (CVE-2026-42897) - Help Net Security