Russian hackers exploit Exchange OWA zero-day for long-term mailbox access

The landscape of cyber security faces a sophisticated challenge as the Russian state-sponsored group, Laundry Bear (Void Blizzard), exploits a critical Outlook Web Access (OWA) vulnerability. Their latest weapon, the OWAReaper backdoor, targets government, telecom, financial, and aerospace sectors across the U.S. and Europe. This “half-click exploit” signifies an evolution in email security threats, requiring immediate attention to robust defense strategies against such Advanced Persistent Threats (APTs).

The Evolving Threat of Laundry Bear (TA488)

The Russian state-sponsored hacking group, Laundry Bear (TA488), consistently refines its attack methodologies. Proofpoint uncovered their latest campaign, deploying the OWAReaper backdoor by exploiting an Exchange Outlook Web Access (OWA) vulnerability. This campaign targets diverse organizations, highlighting the persistent danger of Advanced Persistent Threat (APT) groups.

Half-Click Exploits: A New Frontier in Email Security

Laundry Bear’s strategy centers on ‘half-click exploits’ – XSS vulnerabilities in webmail platforms that trigger malicious code simply by opening a specially crafted email. No suspicious links or attachments are needed. Previously, they used a zero-day XSS flaw in Zimbra to deliver ZimReaper, stealing credentials. This shows attackers weaponizing the act of checking your inbox.

CVE-2026-42897: OWA’s HTML Sanitization Weakness

The OWAReaper campaign exploits CVE-2026-42897, an OWA XSS vulnerability from improper HTML sanitization. This allows arbitrary JavaScript execution upon opening a malicious email. Proofpoint observed Laundry Bear preparing infrastructure by March, before Microsoft’s May 14th advisory. Lures are benign, encouraging opening. Malicious JavaScript loaders and Base64-encoded payloads are subtly embedded, activated by the HTML sanitization issue.

OWAReaper: Beyond Basic Compromise

Proofpoint calls OWAReaper the most sophisticated backdoor delivered via half-click exploits, a significant leap in tradecraft. Executed entirely within the OWA reading pane, it immediately rewrites the email on the Exchange server, removing exploit content, and disables OWA pop-ups and right-click functionality, concealing its presence.

Stealth Capabilities & Credential Theft

OWAReaper gathers vital info: account email, username, and Outlook settings. It also attempts to steal access credentials by creating invisible DOM elements, awaiting browser auto-fill. This subtlety allows harvesting sensitive data without overt user interaction.

Advanced Persistence: Bypassing Remediation

OWAReaper’s most alarming feature is its long-term persistence, designed to maintain access even after system restoration or credential rotation.

1. OAuth & Mailbox Permissions: It steals OAuth tokens via ReadWriteMailbox add-ins, then grants itself Owner-level permissions to the ‘Default’ user on every mail folder. Since these are server-side, password changes or system reinstallation do not revoke access.
2. IndexedDB Cache Poisoning: It injects a malicious iframe into OWA’s offline IndexedDB. This iframe executes whenever a poisoned email is opened from the cache, ensuring repeated access.

Covert C2 and Data Exfiltration

OWAReaper employs dual command-and-control (C2) and redundant data exfiltration methods. C2 channels include GitHub commit messages (querying for encrypted instructions) and parsing emails in the target’s mailbox. Data exfiltration primarily uses HTTPS with AES-CTR encrypted URI paths, proxied through CDN domains. Fallbacks include direct connection to an attacker-defined server and DNS exfiltration, using Base32-encoded DNS packets, a difficult method to detect.

Strengthening Defenses Against APTs

The OWAReaper campaign highlights the critical need for robust cyber security strategies, especially in vulnerability management and email security. Organizations must prioritize immediate patching of Exchange/OWA vulnerabilities and conduct regular audits of mailbox permissions and add-ins. Implementing advanced threat detection, capable of analyzing email content for subtle malicious indicators and monitoring unusual C2 patterns, is crucial. User education on ‘half-click’ exploits is also vital.

Unique Tip: Proactive security teams should routinely audit OWA add-in permissions and Exchange server-side mailbox delegation. Look for changes in Set-MailboxFolderPermission that grant Owner or FullAccess to unusual or low-privileged accounts, as attackers often maintain access via such methods, rendering conventional password resets ineffective.

FAQ

Question 1: What is a “half-click exploit” and why is it dangerous?

Answer 1: A “half-click exploit” leverages XSS vulnerabilities in webmail interfaces, triggering malicious code simply by opening or previewing an email. It’s dangerous because it bypasses traditional phishing defenses that require a click on a link or attachment. Users performing routine email checks unknowingly activate the exploit, making it highly effective and hard to detect via user education alone.

Question 2: How does OWAReaper achieve long-term persistence, even after password resets?

Answer 2: OWAReaper ensures persistence through two main methods. First, it steals OAuth tokens via Outlook add-ins and grants itself Owner-level permissions to the ‘Default’ user on all mail folders through server-side Exchange settings. These server-side permissions persist even after password changes or system rebuilds. Second, it injects a malicious iframe into OWA’s offline IndexedDB cache, ensuring reactivation every time a poisoned email is opened from cache.

Question 3: What immediate steps can organizations take to defend against attacks like OWAReaper?

Answer 3: Immediate defense includes:

1. Patching: Promptly apply all security updates for Microsoft Exchange and OWA.
2. Email Security Gateways: Deploy advanced solutions to detect malicious JavaScript and unusual HTML.
3. Monitor Mailbox Permissions: Regularly audit and enforce least privilege for mailbox permissions and OWA add-ins.
4. Endpoint Detection & Response (EDR): Configure EDR to detect suspicious activity originating from browser processes.

Read the original article