Laundry Bear exploits Exchange OWA zero-day: persistent and invisible espionage

Introduction

The Russian APT group known as “Laundry Bear” (alias Void Blizzard, tracked by Proofpoint as TA488) carried out a sophisticated espionage campaign exploiting a zero‑day vulnerability in Microsoft Exchange Outlook Web Access (OWA). According to a report published on July 29, 2026, the flaw (CVE‑2026‑42897) has been actively exploited since March 2026, nearly two months before Microsoft’s advisory on May 14, 2026. The attack, based on an XSS in the email body, allowed JavaScript code execution with a single click, granting prolonged access to mailboxes and multi‑layered persistence that is difficult to eradicate.

Technical analysis

The vulnerability lies in OWA’s server‑side HTML sanitization engine: insufficient filtering of email messages allowed the injection of malicious JavaScript into the email body. When the message was opened (a “half‑click” attack), the code executed in the victim’s browser context with no additional interaction required. The emails delivered a JavaScript loader, with Base64‑encoded payloads hidden inside seemingly innocuous URLs (social media icons).

The distributed backdoor, named OWAReaper, operates entirely within the OWA reading pane, wiping its traces from the original email and disabling pop‑ups and right‑click to hinder analysis. Its main capabilities include:

• Credential and OAuth token theft via an Outlook add‑in with “ReadWriteMailbox” permissions, which, once installed, grants access to all mailboxes in the organization.
• Server‑side persistence: by granting “Owner” permissions to the default ‘Default’ user on every mailbox folder, it makes access resistant to password resets or client reimaging.
• Client‑side persistence: enables OWA cache and injects a malicious iframe into IndexedDB, re‑executing the code each time the infected message is opened, even from cache.
• C2 communication: queries the GitHub Commit Search API every 24 hours for encrypted messages linked to the victim’s email, or analyzes existing emails in the mailbox.
• Exfiltration: primary via HTTPS to image CDN domains with AES‑CTR encrypted paths, with fallback directly to the attacker’s server or via DNS queries with Base32 payloads.

Impact

The severity is critical: the attack is easy to execute (half‑click), runs code in the browser, and establishes multiple persistence mechanisms. Consequences include:

• Prolonged, unnoticed access to mailboxes, even after credential rotation or OS reinstallation.
• Massive theft of credentials, OAuth tokens, and sensitive content, with the potential for lateral movement using legitimate organizational accounts.
• Affected sectors: government entities (US and Europe), telecommunications, finance, hospitality, and aerospace.

Mitigation

To protect yourself, you must immediately take the following steps:

• Apply Microsoft’s patch for CVE‑2026‑42897 (advisory of May 14, 2026).
• Check for and remove any unusual permissions granted to the ‘Default’ user on Exchange folders (e.g., “Owner”).
• Monitor and block Outlook add‑ins with excessive permissions (especially “ReadWriteMailbox”), using Office 365 restriction policies.
• Inspect network traffic to suspicious CDN domains or DNS queries containing encoded payloads.
• Restrict OWA usage if not essential, and strengthen anti‑XSS controls on incoming emails (e.g., Content‑Security‑Policy headers, client‑side sanitization).

FAQ

1. What makes CVE‑2026‑42897 different from other XSS vulnerabilities?
The flaw lies in OWA’s server‑side HTML sanitization process and allows JavaScript execution upon opening an email (half‑click), with no additional interaction. Moreover, it enables a backdoor that operates solely in the reading pane and provides multiple persistence methods, making it exceptionally insidious.

2. How can I check if my organization has been compromised?
Check Exchange folder permissions for the ‘Default’ user with suspicious permissions (e.g., Owner). Inspect the list of installed Outlook add‑ins, paying special attention to those with “ReadWriteMailbox” permissions. Monitor HTTP requests to unknown CDN domains or DNS queries with anomalous patterns (Base32). Finally, examine mailbox access logs for activity at unusual times.

3. Does the Microsoft patch also remove existing persistence mechanisms?
No, the patch fixes the entry vulnerability (XSS) but does not automatically remove persistent modifications already in place. You must manually revoke anomalous ‘Default’ user permissions, disable malicious add‑ins, and, in some cases, recreate compromised mailboxes. A thorough post‑patch remediation effort is recommended.