The state-sponsored group Laundry Bear is utilizing a sophisticated 'half-click' exploit in Microsoft Exchange OWA to deploy the OWAReaper backdoor, enabling long-term unauthorized access to sensitive mailboxes.

Key Takeaways

  • Russian threat actor Laundry Bear (Void Blizzard) is exploiting CVE-2026-42897 in Microsoft Exchange OWA.
  • The attack is a 'half-click' exploit, requiring only the opening of a malicious email to trigger.
  • The OWAReaper backdoor provides persistent access that survives password changes and system wipes.
  • Targets include government, finance, aerospace, and telecommunications sectors.

A sophisticated cyber espionage campaign has been uncovered targeting global organizations. The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is actively exploiting a zero-day vulnerability in Microsoft Exchange Outlook Web Access (OWA). This campaign delivers a highly advanced backdoor dubbed OWAReaper, designed to grant attackers long-term, stealthy access to target mailboxes.

The Rise of the 'Half-Click' Exploit

According to researchers at Proofpoint, this campaign represents a significant leap in cyber tradecraft. Unlike traditional phishing that requires a user to click a link or download an attachment, this is a 'half-click' exploit. By leveraging the CVE-2026-42897 cross-site scripting (XSS) vulnerability, the attackers can execute arbitrary JavaScript simply when a victim opens a specially crafted email in the OWA reading pane.

Why This Matters

BozokMedia analysis shows that the danger lies in the subtlety of the attack. The hackers use banal subject lines—such as supply-chain updates or gas market indicators—to ensure the email is skimmed and then ignored rather than reported as a threat. This lack of user interaction makes detection via traditional security training extremely difficult.

OWAReaper is arguably the most sophisticated backdoor delivered via half-click exploits observed to date, featuring multi-layered persistence.

What makes OWAReaper particularly terrifying is its ability to maintain long-term persistence. Even if an organization rotates credentials or restores systems from clean images, the attackers can remain inside. The malware exploits Outlook add-ins with ReadWriteMailbox permissions to steal OAuth tokens and modifies server-side permissions to grant itself 'Owner' level access to folders.

Historical Background

This campaign is an evolution of previous activities by the same group. Previously, Laundry Bear utilized a zero-day vulnerability in Zimbra email servers to deploy ZimReaper, a malware focused on stealing 2FA codes and passwords. OWAReaper builds upon this legacy with even more robust evasion and persistence techniques.

Did You Know?: To hide their tracks, these hackers use GitHub commit messages as a command-and-control channel, making their malicious traffic look like legitimate developer activity.

Frequently Asked Questions

Question 1: Can I protect myself by changing my password?
Answer: Not necessarily. Because the malware modifies server-side permissions and uses OAuth tokens, changing your password may not revoke the attacker's access.

Question 2: How can organizations defend against this?
Answer: Immediate application of Microsoft's security patches for CVE-2026-42897 is critical, alongside monitoring for unauthorized changes to mailbox permissions.