Russian state-sponsored hackers affiliated with TA488, also known as Laundry Bear and Void Blizzard, have been actively exploiting a maximum-severity vulnerability in Microsoft Exchange Server to compromise unpatched systems and extract sensitive information, according to security researchers at Proofpoint.
The vulnerability, designated CVE-2026-42897, is a cross-site scripting flaw in how Exchange handles HTML content embedded in emails. Microsoft provided guidance on mitigating the issue in May and released a patch in July. The vulnerability allows attackers to execute malicious JavaScript code when a user merely opens a compromised email in Outlook Web Access, a method known as a “half-click” exploit that requires minimal user interaction.
TA488 has developed a sophisticated custom-built implant called OWAReaper that leverages this vulnerability to establish persistent backdoor access. The malware is executed within the OWA reading pane and uses legitimate Outlook application programming interfaces to hide its presence by removing exploit content from emails. The implant disables security features such as pop-ups and right-click functionality while operating, then harvests user credentials by intercepting autofill data from browsers.
Once OWAReaper establishes a foothold, it stores encrypted copies of itself in the browser’s local storage using legitimate OWA configuration keys. This persistence mechanism means the malware automatically re-executes each time a user opens an OWA session. From there, attackers can steal OAuth tokens to gain access to mailboxes across the entire authenticated network.
Security researchers emphasized that this access persists on the server side and cannot be removed through standard remediation procedures such as resetting user credentials or re-imaging the compromised device. Proofpoint recommended that affected organizations revoke and audit their Exchange Web Services tokens, remove default user folder permissions, clear local storage keys, and monitor for outbound connections to identified command-and-control servers.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI