Full Report
The Russian threat actors recently linked to the exploitation of a now-patched vulnerability in Zimbra have been observed exploiting another vulnerability, this time in Microsoft Outlook Web Access (OWA), to target U.S. and European government entities, as well as the telecommunications, financial, hospitality, and aerospace sectors. The activity, which began on July 22, 2026, involves the
Analysis Summary
# Threat Actor: Laundry Bear
## Attribution & Identity
**Laundry Bear** is a Russian-affiliated threat actor. The group is tracked by various security research organizations under several aliases and designations, including:
* **Aliases:** CL-STA-1114, TA488, UNK_PitStop, and Void Blizzard.
* **Associations:** Recently linked to the exploitation of Zimbra vulnerabilities before pivoting to Microsoft Exchange exploits.
## Activity Summary
Beginning around July 22, 2026 (with traces dating back to May 2026), Laundry Bear launched a sophisticated campaign exploiting **CVE-2026-42897**, a Cross-Site Scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA). This campaign is characterized by "half-click" exploits, where a user only needs to view a specifically crafted email to trigger the compromise, requiring no interaction with links or attachments.
## Tactics, Techniques & Procedures
* **Phishing & Social Engineering:** Uses compromised accounts and Proton Mail addresses to send vague, informational emails (e.g., supply chain analyses, gas market metrics) to avoid suspicion.
* **Vulnerability Exploitation:**
* **CVE-2026-42897:** XSS in Microsoft OWA (CVSS 8.1).
* **CVE-2025-66376:** XSS in Zimbra Classic UI (historical).
* **Half-Click Execution:** Employs the `onload=` event handler to parse the message body and execute malicious JavaScript automatically.
* **Stealth & Evasion:**
* Hides payload blobs in social media icons within the HTML message.
* Uses Outlook APIs to rewrite the original email on the server to remove the exploit after execution, erasing evidence of the initial breach.
* **Credential Harvesting:** Creates invisible DOM elements to trick browser autofill features into capturing saved OWA credentials.
## Targeting
* **Sectors:** Government (U.S. and European), Telecommunications, Financial, Hospitality, and Aerospace.
* **Geography:** Primarily United States and Europe.
* **Victims:** High-value government entities and critical infrastructure providers.
## Tools & Infrastructure
* **Malware:**
* **OWAReaper:** A sophisticated JavaScript browser-based implant designed for persistent access within OWA.
* **ZimReaper:** (Historical) A predecessor to OWAReaper used for harvesting data from Zimbra environments.
* **Infrastructure:**
* **Proton Mail:** Used for sending malicious emails.
* **Compromised Accounts:** Leverages legitimate but compromised third-party accounts to bypass spam filters.
* **C2:** Communicates via encrypted JavaScript fragments; specific C2 domains/IPs were not detailed in the snippet provided but are generally defanged (e.g., `example[.]com`).
## Implications
Laundry Bear demonstrates a high level of technical maturity by weaponizing "half-click" exploits that bypass traditional user-awareness training (which focuses on not clicking links). Their ability to maintain access even after credential rotation by using browser-based implants indicates a long-term espionage objective. The shift toward mass-mailing lures suggests an attempt to blend into common white noise to target a broader range of high-value sectors.
## Mitigations
* **Patch Management:** Prioritize security updates for on-premises Microsoft Exchange servers, specifically addressing CVE-2026-42897.
* **Session Management:** Enforce shorter session timeouts for OWA to limit the effectiveness of session-based implants.
* **Browser Security:** Disable browser autofill for sensitive enterprise applications via Group Policy (GPO) to prevent OWAReaper from capturing credentials.
* **Email Filtering:** Configure Content Security Policy (CSP) headers where possible and use advanced email security solutions capable of detecting hidden JavaScript blobs in HTML email bodies.