Nation-stateJul 29, 2026

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

Russian hackers exploit Exchange OWA zero-day for long-term mailbox access.

The Russian state-sponsored group Laundry Bear (Void Blizzard/TA488) is exploiting a zero-day XSS vulnerability (CVE-2026-42897) in Exchange Outlook Web Access (OWA) to deliver a sophisticated backdoor named OWAReaper. This 'half-click' exploit targets government entities and companies across various sectors in the U.S. and Europe, enabling long-term mailbox access and credential theft.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Microsoft?

Get an email when a new story names Microsoft, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

The Russian state-sponsored group Laundry Bear (Void Blizzard/TA488) leveraged an unpatched XSS zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange's Outlook Web Access to install a persistent backdoor called OWAReaper, enabling long-term covert access to victim mailboxes. Because this was a zero-day exploit, organizations had no vendor-supplied patch available at the time of initial compromise, making proactive detection and defense-in-depth controls critically important. The campaign highlights the danger of exposing legacy or unmonitored internet-facing mail infrastructure to sophisticated nation-state actors. Credential theft combined with persistent mailbox access creates a high-impact intelligence collection capability that can persist undetected for months if monitoring is insufficient.

What helps against this

How we list vendors

Microsoft affected Proofpoint research

Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
For exampleMicrosoft Defender for Identity Okta Identity Threat Protection Huntress Managed ITDR all options
Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleHuntress Managed EDR SentinelOne Singularity Endpoint ESET PROTECT all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleCheck Point Harmony Email & Collaboration Proofpoint Core Email Protection Cloudflare Email Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-42897
cve — CVE-2025-66376
malware — OWAReaper
malware — ZimReaper

Entities

Laundry Bear (threat_actor)Void Blizzard (threat_actor)TA488 (threat_actor)Exchange Outlook Web Access (product)Zimbra email servers (product)Microsoft (vendor)