[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWo-XVZLDc2-g8I0lBaipeHBCb6pm6jIF5siXDSehPo4":3},{"article":4,"iocs":55,"watch_terms":69,"solutions":70,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0ddc5039-7349-4c54-8b62-21ae7202fe73","Russian hackers exploit Exchange OWA zero-day for long-term mailbox access","russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access-e595db","The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper. [...]","The Russian state-sponsored group Laundry Bear (Void Blizzard\u002FTA488) is exploiting a zero-day XSS vulnerability (CVE-2026-42897) in Exchange Outlook Web Access (OWA) to deliver a sophisticated backdoor named OWAReaper. This 'half-click' exploit targets government entities and companies across various sectors in the U.S. and Europe, enabling long-term mailbox access and credential theft.","Russian hackers exploit Exchange OWA zero-day for long-term mailbox access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2024\u002F05\u002F09\u002FRussian__hackers.jpg","2026-07-29T23:44:07+00:00","2026-07-30T00:00:23.685683+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Laundry Bear","threat_actor",{"name":21,"type":19},"Void Blizzard",{"name":23,"type":19},"TA488",{"name":25,"type":26},"Exchange Outlook Web Access","product",{"name":28,"type":26},"Zimbra email servers",{"name":30,"type":31},"Microsoft","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66],{"type":57,"value":58,"context":59},"cve","CVE-2026-42897","Exchange OWA XSS vulnerability exploited as zero-day",{"type":57,"value":61,"context":62},"CVE-2025-66376","Zimbra email server XSS vulnerability exploited previously",{"type":49,"value":64,"context":65},"OWAReaper","Sophisticated backdoor delivered via OWA exploit",{"type":49,"value":67,"context":68},"ZimReaper","Malware used in previous Zimbra server attacks",[30,25,28],{"controls":71,"vendors":155},[72,100,126],{"slug":73,"name":74,"problem":75,"products":76},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[77,84,92],{"vendor_slug":78,"vendor_name":30,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":101,"name":102,"problem":103,"products":104},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[105,110,118],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":106,"product_name":107,"url":108,"description":109},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":127,"name":128,"problem":129,"products":130},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[131,139,147],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[156,159],{"slug":78,"name":30,"logo_path":79,"roles":157},[158],"affected",{"slug":140,"name":141,"logo_path":142,"roles":160},[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":179},"russian-apt-exploits-exchange-owa-zero-day-for-persistent-mailbox-access","Russian APT Exploits Exchange OWA Zero-Day for Persistent Mailbox Access","The Russian state-sponsored group Laundry Bear (Void Blizzard\u002FTA488) leveraged an unpatched XSS zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange's Outlook Web Access to install a persistent backdoor called OWAReaper, enabling long-term covert access to victim mailboxes. Because this was a zero-day exploit, organizations had no vendor-supplied patch available at the time of initial compromise, making proactive detection and defense-in-depth controls critically important. The campaign highlights the danger of exposing legacy or unmonitored internet-facing mail infrastructure to sophisticated nation-state actors. Credential theft combined with persistent mailbox access creates a high-impact intelligence collection capability that can persist undetected for months if monitoring is insufficient.",[167,168,169,170,171,172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-17: Remote Access","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST SP 800-53 SC-28: Protection of Information at Rest","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1114: Email Collection","MITRE ATT&CK T1133: External Remote Services","GDPR Article 32: Security of Processing","GDPR Article 33: Notification of Personal Data Breach",{}]