Russian Hackers Exploit Microsoft Exchange OWA Zero-Day to Deploy OWAReaper Backdoor

Russian state-sponsored hackers are actively exploiting a newly discovered vulnerability in the Outlook Web Access (OWA) of Microsoft Exchange. This group, which operates under the name Laundry Bear or Void Blizzard, took advantage of this vulnerability to deploy the backdoor OWAReaper. Security firm Proofpoint spotted the activity about a week ago.

The attackers are targeting various organizations across the United States and Europe. These include government entities and companies in the telecommunications, financial, hospitality, and aerospace sectors. The campaign demonstrates a significant improvement in the group’s hacking capabilities.

In terms of the nature of the vulnerability, it is classified as CVE-2026-42897 and has a CVSS score of 8.1. Also, it affected on-premise editions of Microsoft Exchange Server 2016, 2019, and Subscription Edition.

Although Microsoft disclosed it on May 14, the discovery showed that the attackers had set up their infrastructure in March, approximately two months before Microsoft issued the warning. This means the group operated with a genuine zero-day for an extended period.

How the Attack Unfolds

The exploit is via a cross-site scripting vulnerability that exists due to improper HTML sanitization in OWA. When a user opens a uniquely created email in the Outlook Web Access app, the server fails to properly clean the HTML code in the message body. The lapse allows malicious JavaScript to run automatically within the browser session of the user.

According to Proofpoint researchers, this is a half-click exploit since the victim only has to open the malicious email for the attack to take place. No additional clicks on links or attachments are required.

The attackers deliberately use banal subject lines about supply chains, gas markets, and tourism indicators. This approach encourages targets to open and skim the message, then dismiss it as junk without reporting it.

The malicious emails contain JavaScript loader and Base64 encoded payload blobs that are embedded in URLs of social media icons. The malicious code appears after the character # in URLs, which allows it to pass through normal sanitization processes.

The OWAReaper Backdoor

The exploit delivers a backdoor that researchers call OWAReaper. Proofpoint describes it as the most advanced backdoor delivered through half-click exploits they have ever seen. The malware executes entirely within the OWA reading pane, leaving no conventional file on the disk of the victim.

Once active, OWAReaper performs several malicious actions. It utilizes Outlook APIs to recreate the original email on the Exchange server, stripping out the exploit code to erase evidence of the intrusion. The malware disables all OWA pop-ups and right-clicks during its run so that the victims may not suspect anything unusual.

After that, OWAReaper starts stealing various information from the targeted account, including email address, username, and Outlook settings. It also uses different invisible forms embedded into the Document Object Model of the browser to steal the login credentials. It completes the theft by waiting until the auto-filling of the browser takes place.

OWAReaper reflects the advanced version of ZimReaper malware that the same group earlier utilized in their attack on Zimbra email servers. The researchers observed significant code and behavioral overlaps between the two tools, including how they gather autofill passwords from the DOM with identical techniques. The group’s activities are part of a larger Russian cybercrime ecosystem that has laundered $2 billion through dark web markets and crypto exchanges.

Persistent Access that Survives Password Resets

The most alarming capability of OWAReaper is its ability to maintain mailbox access even after the victim’s system is restored from a clean image or their credentials are rotated. The malware achieves this through two distinct persistence mechanisms.

The first mechanism operates on the server side. OWAReaper checks for installed Outlook add-ins that have ReadWriteMailbox permissions. When it finds such an add-in, it exploits that access to capture OAuth tokens via the process of GetClientAccessToken.

Then, it prompts UpdateFolder to approve Owner-level permissions to the Default user, a low-permission preset alias present in all Microsoft Exchange tenants, on every mail folder.

This permission changes lives on the Exchange server rather than the device of the victim. Consequently, whether the victim changes their compromised password or reinstalls the system, it will not revoke the access of the attackers. Any authenticated account within the organization can then access the compromised mailbox.

The second persistence mechanism involves OWA’s offline cache. OWAReaper enables caching and injects a malicious iframe in the HTML of messages stored in the IndexedDB database of the OWA. This iframe executes every time the victim opens a poisoned email from the cache, re-infecting the target even after a host is re-imaged.

Command and Control Channels

OWAReaper supports two methods for receiving attacker commands. The first method uses GitHub commit messages as a channel. Every 24 hours, the malware interrogates the Commit Search API of GitHub. It looks for encrypted messages in a specific format. These messages must include the email address of the target.

The second method relies on inbound emails to the compromised mailbox. OWAReaper checks the IndexedDB for specific message structures. These structures contain the target’s email address followed by Base64 text. The malware polls this offline cache every five minutes. It checks for new commands received in the last 30 minutes.

The malware also implements two data exfiltration protocols. The primary method uses HTTPS together with AES-CTR-encrypted paths. It proxies these through legitimate CDN domains. Examples include Weserv.nl, i3.wp.com, and slack-imgs.com.

If this primary method fails, OWAReaper uses DNS label tunneling. It exfiltrates data within subdomains of standard DNS queries. These queries go to an attacker-controlled domain.

These backup mechanisms make the malware highly resilient. Proofpoint researchers note the group uses generic domain names. Terms like ‘CDN’ or ‘DNS’ help traffic blend in. This makes detection much harder.

The persistent access of the group poses a significant threat. Standard remediation steps cannot easily address it. Organizations running on-premises Exchange servers should act now. They must apply Microsoft’s security update immediately. They should also audit mailbox permission structures directly on the Exchange server.