[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwaYwgO-FZt3uaKTjA6HgxaLkNdPnGtKKQhE1_qx5dSk":3},{"article":4,"iocs":48,"watch_terms":63,"solutions":64,"lesson":162},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"36b6be28-358d-4aaa-b7b7-b97d8525663a","Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation","russian-hackers-exploit-microsoft-owa-flaw-to-keep-mailbox-access-after-credenti-08772e","The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the","Russian-linked threat actor Laundry Bear (TA488) is actively exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Outlook Web Access, to target U.S. and European government agencies alongside the telecommunications, financial, hospitality, and aerospace sectors. The attack campaign, which began July 22, 2026, uses half-click exploits with generic phishing emails that trigger a previously unknown JavaScript backdoor called OWAReaper, enabling persistent access within the webmail client even after credential rotation. The malware rewrites emails on the Exchange server to remove exploit traces, representing an evolution of the group's earlier ZimReaper tool used against Zimbra users.","Russian threat actors exploit Microsoft OWA XSS flaw (CVE-2026-42897) to maintain persistent mailbox access","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Frussian-hackers-exploit-microsoft-owa.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiAHLuK9rcrkKZxWdmWf50USFH75iYP3nViQrL7sP_6gBJUipIQfUTU0XmA2xnOTR57ZCQWd83Y2joLatEV3XVV10ph4uQV7LrrYLzDCfW4dBiDyvVtpyhD3fgrGY7J2hFbNtCzzp4CGU7DxDYCxnuzJtgCJKCMFuRxloks-iW4dXJlZADetaMQK5rZiUKF\u002Fs1600\u002Foutlook.jpg","2026-07-30T07:40:48+00:00","2026-07-30T08:00:20.746266+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"Laundry Bear","threat_actor",{"name":21,"type":19},"TA488",{"name":23,"type":24},"Microsoft","vendor",{"name":26,"type":27},"Microsoft Outlook Web Access (OWA)","product",{"name":29,"type":27},"Microsoft Exchange",{"name":31,"type":24},"Zimbra","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":32,"icon":34,"name":35,"slug":36},null,"Zero-day","zero-day",[38,43],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[49,53,56,60],{"type":50,"value":51,"context":52},"cve","CVE-2026-42897","Cross-site scripting vulnerability in Microsoft OWA exploited by Laundry Bear since at least May 2026",{"type":50,"value":54,"context":55},"CVE-2025-66376","XSS flaw in Zimbra Classic UI exploited by Laundry Bear since July 2025",{"type":57,"value":58,"context":59},"malware","OWAReaper","JavaScript browser-based backdoor deployed via half-click exploits in Microsoft OWA for persistent access",{"type":57,"value":61,"context":62},"ZimReaper","JavaScript payload used to harvest 90 days of victim mail in earlier Zimbra exploitation campaign",[23,31,26],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[154,159],{"slug":155,"name":23,"logo_path":156,"roles":157},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[158],"affected",{"slug":130,"name":131,"logo_path":132,"roles":160},[161],"reported_by",{"slug":163,"title":164,"body":165,"framework_refs":166,"framework_notes":182},"owa-xss-flaw-lets-russian-hackers-survive-credential-resets","OWA XSS Flaw Lets Russian Hackers Survive Credential Resets","Russian threat actor Laundry Bear is exploiting CVE-2026-42897, an unpatched cross-site scripting flaw in Microsoft Outlook Web Access, to deploy a JavaScript backdoor called OWAReaper that persists inside the webmail client even after victims rotate their credentials. This attack is particularly dangerous because credential rotation — a standard incident response procedure — provides no relief once the backdoor is embedded, effectively nullifying one of the most common remediation steps organizations rely on. Compounding the threat, the malware actively rewrites Exchange server emails to erase forensic evidence of the exploit, blinding defenders and hindering investigation. This campaign highlights that unpatched internet-facing webmail infrastructure remains a high-value entry point for nation-state actors targeting government and critical sectors. Organizations cannot rely solely on credential hygiene when client-side persistence mechanisms bypass authentication entirely.",[167,168,169,170,171,172,173,174,175,176,177,178,179,180,181],"CIS Control 7: Continuous Vulnerability Management","CIS Control 8: Audit Log Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-61r2: Incident Response — Eradication & Recovery Phase","NIST CSF DE.CM-4: Malicious Code Detection","NIST CSF RS.MI-2: Incident Mitigation","NIST AC-17: Remote Access Controls","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","MITRE ATT&CK T1059.007: JavaScript Execution","MITRE ATT&CK T1565.001: Stored Data Manipulation","MITRE ATT&CK T1190: Exploit Public-Facing Application","ITIL: Change Management — Emergency Change Procedure","GDPR Article 32: Security of Processing (breach risk reduction)","GDPR Article 33: Notification of a Personal Data Breach",{}]