Russian Hackers Exploit Critical Microsoft Exchange Flaw
Kremlin-backed TA488 group uses zero-day in Outlook Web Access to install OWAReaper malware with persistent server access.
Russian state-backed hackers from the group TA488 (also tracked as Laundry Bear or Void Blizzard) are exploiting a maximum-severity vulnerability in Microsoft Exchange Server to deploy a sophisticated backdoor called OWAReaper. The flaw, CVE-2026-42897, is a cross-site scripting (XSS) issue in Outlook Web Access (OWA) that allows attackers to execute malicious JavaScript by simply opening an email. Microsoft patched the vulnerability in July 2024 but Proofpoint researchers believe TA488 may have exploited it as a zero-day.
OWAReaper is a custom JavaScript-based implant that operates entirely within OWA’s reading pane. It abuses Outlook APIs to rewrite emails on the Exchange server, removing exploit traces while disabling browser pop-ups and right-click functionality. The malware creates unique session keys to harvest user credentials, including saved OWA passwords and OAuth tokens. It persists even after credential rotation or device reimaging, as it embeds itself in the Exchange server’s localStorage. Proofpoint warns that removing the backdoor requires manual cleanup, including revoking Exchange Web Services tokens and clearing OWA’s indexDB.
- TA488 (Kremlin-backed) exploits CVE-2026-42897, a critical XSS flaw in Microsoft Exchange Server, via 'half-click' attacks in Outlook Web Access (OWA).
- OWAReaper malware provides persistent server-side access, steals credentials/OAuth tokens, and remains active even after patching or credential changes.
- Proofpoint recommends revoking Exchange tokens, clearing OWA localStorage, and blocking C2 domains like asecdns[.]com to mitigate infections.
Why It Matters
This attack chain highlights escalating cyber espionage tactics, threatening enterprise email security and requiring immediate patching and forensic audits.