Russia-aligned threat actor TA488, also known as Laundry Bear and Void Blizzard, began a new wave of Exchange exploitation on July 22, 2026. The campaign weaponizes CVE-2026-42897, a cross-site scripting flaw in Outlook Web Access, to deliver a previously unknown JavaScript backdoor that Proofpoint's threat research team calls OWAReaper.
What makes this campaign worth a dedicated write-up: OWAReaper can survive credential rotation and full device re-imaging. The persistence mechanism is server-side, living in Exchange folder permissions and OWA's own sync settings. Reimaging the victim's laptop does not evict the actor.
How the attack works
The infection chain requires exactly one action from the victim: opening an email in Outlook Web Access. No attachments. No links to click. Just opening the message.
TA488 sends emails with deliberately bland subject lines: "Semiconductor Supply Chain Indicators," "Global Tourism Indicators," "Nuclear Energy Update." The content looks like a generic industry newsletter. There is no call to action. The point is to get the email opened and skimmed without triggering suspicion, because there are no indicators to report. No URLs, no suspicious attachments.
When a recipient opens the email in OWA, the Exchange server mishandles the HTML in the message body, executing a JavaScript loader embedded inside social media icon placeholders. The loader assembles and executes OWAReaper from Base64 fragments stored in the message.
OWAReaper: the implant that lives on the server
OWAReaper runs entirely inside the OWA reading pane. Once executed, it immediately self-covers: it rewrites the original email on the Exchange server to remove the exploit content, then disables OWA pop-ups and right-click access while it initializes.
The implant collects the victim's email address, username, and saved OWA credentials via invisible DOM autofill elements. It then writes an encrypted copy of itself into the browser's localStorage under a key that OWA's own sync process evaluates on every tab open. The result: every time the victim opens OWA, OWAReaper re-executes automatically.
The most consequential persistence mechanism is the Exchange folder permission change. OWAReaper calls GetClientAccessToken via any installed Outlook add-in with ReadWriteMailbox permissions, then calls UpdateFolder to grant Owner-level access to the "Default" user on every mail folder. The "Default" user is a low-permission preset account present in every Microsoft Exchange tenant. Once this grant is in place, any authenticated user in the same organization can read the victim's mailbox. That permission lives on the Exchange server. Resetting the victim's password does nothing. Reimaging the victim's device does nothing. The attacker retains mailbox access until an administrator explicitly removes the folder permission grant from the Exchange server.
A secondary persistence path: OWAReaper injects a hidden iframe into emails stored in OWA's offline IndexedDB cache. Each time a cached email is opened, OWAReaper re-executes, even on a freshly reimaged device if the browser cache is restored.
Command and control
OWAReaper uses two C2 channels. The primary method queries GitHub's Commit Search API every 24 hours for specially crafted commit messages addressed to the target's email. Commands arrive AES-CTR encrypted with a per-session key. The secondary channel reads inbound emails from TA488 operators, looking for the same command structure embedded in bland lure emails. Data exfiltrates over HTTPS, proxied through legitimate image CDN services including Weserv, WordPress's image CDN, and Slack's image CDN, blending into normal browser traffic. DNS label tunneling serves as a fallback if HTTPS exfiltration fails.
Patch status and remediation
Microsoft patched CVE-2026-42897 in an out-of-band emergency release in late May 2026, with a permanent fix on June 9, 2026. Organizations running a patched Exchange Server are not vulnerable to the initial delivery. But if any user in your environment received and opened a TA488 email between March 2026 and the June 9 patch, OWAReaper may already be present in your environment.
Proofpoint's recommended remediation steps:
- Revoke and audit Exchange Web Services tokens for all installed Outlook add-ins.
- Audit and remove any Exchange folder permission grants to the "Default" user.
- Clear OWA's offline IndexedDB (owa_offline_db) and the PageDataPayload.OwaUserDefaultSettings localStorage key on affected endpoints.
- Block or alert on outbound connections to known OWAReaper C2 infrastructure: asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, tdndns[.]com.
Emerging Threats detection rules ET 2071330 through 2071335 cover the exploit, C2 beacons, and DNS tunnel exfiltration.
Why TA488 is worth watching
TA488 went dark between February 2026 and July 22, 2026. When it re-emerged, it brought a meaningfully upgraded malware framework. OWAReaper is more sophisticated than ZimReaper, the previous webmail implant the group used against Zimbra. The infrastructure for this campaign was created in March 2026, two months before Microsoft disclosed CVE-2026-42897 as actively exploited. It is feasible that TA488 operated this as a zero-day for roughly three months before the patch arrived.
The sectors targeted in the July 22 wave: US and European government entities, telecommunications, finance, hospitality, and aerospace. The campaign volume is broader than prior TA488 operations, likely an intentional choice to blend malicious traffic into normal mass-mailing patterns.
Proofpoint's July 29 publication notes this as the most sophisticated backdoor the team has observed delivered via half-click exploits. Combined with TA488's apparent capability to identify and operate a zero-day against Exchange OWA before the patch window opened, organizations with on-premises Exchange should treat this as an active threat requiring a manual hunt even with patches applied.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss Exchange security hardening or threat actor tracking for your organization.