RussianTA488 Returns With Persistent Outlook Web Access Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-42897 | Cross-Site Scripting in Microsoft Exchange Server Actively Exploited by Laundry Bear CVE-2026-42897 is an improper-neutralization flaw (CWE-79) in Microsoft Exchange Server that lets an unauthenticated remote attacker perform cross-site scripting and carry out spoofing. Per the CVSS vector (AV:N/PR:N/UI:R), exploitation requires a victim to interact with attacker-controlled content — reported attacks by the Russian actor Laundry Bear (TA488) trigger when a crafted email is opened in Exchange's webmail interface (Outlook Web Access). The attacker gains the ability to spoof the victim within their webmail session, and reported intrusions show mailbox access persisting even after organizations rotate credentials. Any organization running on-premises Microsoft Exchange Server or Exchange Server Subscription Edition is potentially exposed, particularly those publishing webmail to the internet; specific affected version ranges are not provided in the available data. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2026-05-15 and carries a very high EPSS score of 71.2%, though no public proof-of-concept is known. Do: Apply Microsoft's security update for CVE-2024-42897 to all on-premises Exchange and Exchange Subscription Edition servers per vendor guidance — no specific patch versions are provided in the available data, so consult the vendor advisory for build numbers. Federal agencies must patch or apply mitigations per BOD 22-01 given the KEV listing. Because reported attacks (Laundry Bear/TA488) maintain mailbox access after password resets, treat any suspected compromise as persistent: review OWA access logs and inbox rules for anomalies, and invalidate active webmail sessions and tokens, not just credentials. | 6.1 | 71% | KEV |
| large≈20,000+ internet-exposed Exchange servers (public-scan reporting) |
Full article499 words · extracted from infosecurity-magazine.com · click to collapse
A Russia-aligned espionage group has resurfaced after months without observed activity, using a half-click exploit against on-premises Outlook Web Access (OWA) to plant a browser-resident implant and establish server-side persistence that can survive credential rotation and device re-imaging.
According to new research from Proofpoint published on July 29, TA488, also tracked as Void Blizzard and Laundry Bear, began the campaign on July 22, one day before the company's joint advisory with the NSA and partner agencies on the group's earlier Zimbra activity. It had not been seen since February.
Targets spanned US and European government entities plus the telecommunications, financial, hospitality and aerospace sectors. The volume was unusual for the group, which Proofpoint suggested may have been deliberate to blend into mass-mailing spam.
Banal Lures, No Clicks Required
The messages exploited CVE-2026-42897, a cross-site scripting flaw affecting on-premises Exchange Server, not Exchange Online.
Opening the email in a vulnerable OWA client caused the victim's browser to execute the embedded JavaScript within their authenticated session.
Lures were deliberately unremarkable, with subject lines covering semiconductor supply chains, gas markets and tourism metrics.
Proofpoint said the banality was likely deliberate, so the recipient opened and skimmed the message, then dismissed it as junk without reporting it, leaving no suspicious links or attachments to flag.
Persistence That Outlives the Device
The payload was OWAReaper, a previously unknown JavaScript implant Proofpoint called the most sophisticated half-click backdoor it has seen. It built on ZimReaper from the group's Zimbra campaigns, dropping that tool's mass email exfiltration.
OWAReaper ran entirely in the OWA reading pane with no conventional file on disk. It rewrote the original email on the server to strip the exploit, harvested saved credentials, then hid an encrypted copy of itself in browser localStorage under a legitimate OWA settings key, so every new tab re-executed it.
Its most durable mechanism was server-side: where add-ins with mailbox write permissions existed, it stole OAuth tokens and granted Exchange's low-privilege Default user Owner-level permissions on every mail folder, opening the mailbox to any authenticated account in the organization.
It also planted a hidden iframe in messages held in OWA's offline IndexedDB cache, which re-infected the target even after the host was re-imaged. Because the folder-permission grant lived server-side and required deliberate removal from Exchange, credential rotation and re-imaging did not evict the actor.
Two Command Channels, Two Exfiltration Routes
Commands arrived via GitHub commit messages, queried daily, or inbound emails polled every five minutes. Exfiltration occurred over HTTPS, proxied through legitimate image content delivery networks, with a fallback to DNS tunneling.
The campaign's infrastructure dates to March 2026, roughly two months before Microsoft disclosed the flaw, making zero-day use feasible, though registration dates alone don't confirm when exploitation began. Microsoft has since released Exchange security updates addressing the flaw.
Beyond patching, Proofpoint urged defenders to revoke Exchange Web Services tokens, strip Default-user folder grants and clear OWA's offline database and localStorage key.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/ta488-outlook-half-click-owareaper/