Russian APT Exploits OWA Zero-Day to Survive Password Resets — CVE-2026-42897
❓ What:
Threat group Laundry Bear (aka TA488/Void Blizzard), previously tied to Zimbra zero-day exploitation, is now exploiting an XSS vulnerability in Microsoft Outlook Web Access tracked as CVE-2026-42897 (CVSS 8.1) thehackernews
Activity began July 22, 2026, targeting U.S. and European government entities plus telecom, financial, hospitality, and aerospace sectors thehackernews
It's a "half-click" exploit — simply viewing the email triggers the compromise, no clicks or attachments needed, using vague lures like supply chain analyses or tourism/gas market updates thehackernewsthehackernews
Deploys a new implant called OWAReaper, which runs entirely in the browser inside the OWA reading pane
Microsoft flagged exploitation dating back to May 2026, but Proofpoint found attacker infrastructure created in March 2026 — suggesting possible zero-day use before disclosure thehackernews
⚠️ Impact:
The implant grants itself Owner-level permissions on mail folders, giving complete mailbox access to any authenticated user in the org thehackernews
Critically: this persistence lives server-side and survives credential rotation and full device re-imaging — standard IR containment steps won't evict the actor thehackernews
Secondary persistence via a hidden iframe in OWA's offline IndexedDB cache re-infects the target every time they reopen the malicious email, even after a re-image thehackernews
Dual C2 channels (GitHub Commit Search API queried every 24 hours, or direct attacker emails) plus DNS tunneling as an exfil fallback make it resilient to network-layer blocking thehackernews
💡 Recommendations:
Patch CVE-2026-42897 immediately if running on-prem Exchange/OWA
Don't rely on credential rotation or re-imaging alone as remediation — manually audit and revoke folder-level Owner permissions and mailbox delegate grants on Exchange
Hunt for anomalous mailbox permission changes, unusual Outlook add-in OAuth grants, and outbound DNS query patterns
Review IndexedDB/offline cache artifacts on affected endpoints, not just live inbox content
Read the full story HERE