Full Report
The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper. [...]
Analysis Summary
This report summarizes the activities of the Russian state-sponsored threat actor known as Laundry Bear (TA488), specifically regarding their exploitation of Microsoft Exchange vulnerabilities to deploy the OWAReaper backdoor.
# Threat Actor: Laundry Bear
## Attribution & Identity
* **Primary Names:** Laundry Bear, TA488
* **Aliases:** Void Blizzard
* **Origin:** Russian state-sponsored
* **Associated Groups:** Behavioral overlaps suggest a link to previous actors utilizing "half-click" XSS exploits for cyber-espionage.
## Activity Summary
Proofpoint recently identified a campaign (active as of July 2026) where Laundry Bear exploited a zero-day vulnerability in Microsoft Exchange Outlook Web Access (OWA). The campaign utilizes "half-click" exploits—malicious emails that trigger code execution as soon as the user opens the message in a web browser, requiring no clicks on links or attachments.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of CVE-2026-42897 (XSS in OWA) via improperly sanitized HTML in email bodies.
* **Execution:** JavaScript loader and Base64-encoded payloads embedded in social media icon URLs within the email.
* **Evasion:**
* Uses Outlook APIs to rewrite the malicious email on the server to remove the exploit code after execution.
* Disables OWA pop-ups and right-click functionality during execution.
* Lures are designed as "banal" corporate communications (supply chain analysis, tourism/gas market reports) to avoid reporting.
* **Credential Theft:** Injects invisible elements into the Document Object Model (DOM) to capture credentials from browser auto-fill.
* **Persistence:**
* Abuses `GetClientAccessToken` to steal OAuth tokens via Outlook add-ins.
* Uses `UpdateFolder` to grant "Owner-level" permissions to the 'Default' user alias across all mail folders, ensuring access even after password resets.
* Injects malicious iframes into the OWA offline IndexedDB cache.
* **Command & Control (C2):**
* Primary: Queries GitHub Commit Search API for encrypted messages.
* Secondary: Parses specific Base64-structured strings from emails sent to the victim's inbox.
* **Exfiltration:**
* Encrypted HTTPS URI paths proxied through image CDN domains.
* Fallback: Direct connection to actor-controlled infrastructure.
* Fallback: DNS exfiltration using Base32 encoding.
## Targeting
* **Sectors:** Government (U.S. and Europe), Telecommunications, Finance, Hospitality, and Aerospace.
* **Geography:** Primarily United States and Europe.
* **Victims:** Broad range of organizations within the sectors listed above; specific entity names were not disclosed.
## Tools & Infrastructure
* **Malware Families:**
* **OWAReaper:** A sophisticated backdoor tailored for OWA environments.
* **ZimReaper:** An earlier iteration used to target Zimbra email servers (CVE-2025-66376).
* **Infrastructure:**
* GitHub (used for C2 instructions).
* Image CDNs (used for data exfiltration proxying).
* Targeted lures (supply-chain and market research themes).
## Implications
Laundry Bear represents a highly capable espionage threat. Their move toward "half-click" zero-day exploits indicates a sophisticated understanding of webmail architecture. Their ability to achieve server-side persistence—which survives credential rotation and system reimaging—renders traditional remediation steps insufficient and poses a long-term risk to sensitive communications.
## Mitigations
* **Patch Management:** Prioritize patching CVE-2026-42897 and CVE-2025-66376.
* **Mailbox Auditing:** Regularly audit mailbox folder permissions for unauthorized "Owner" or "Delegate" assignments, especially those involving the "Default" user.
* **Add-in Governance:** Restrict or monitor Outlook add-ins that require `ReadWriteMailbox` permissions.
* **Network Monitoring:** Monitor for unusual DNS traffic (Base32 encoded subdomains) and unexpected connections to GitHub API or unknown image CDNs.
* **Session Management:** Implement strict OAuth token expiration policies and monitor for anomalous token usage.