Breaking: Russian APT Laundry Bear Deploys OWAReaper — Zero-Click Persistence on Exchange OWA — 10 August 2026

Laundry Bear OWAReaper: Russian APT Pivots from Zimbra to Microsoft OWA with Zero-Click Persistence

Russian state-sponsored threat group Laundry Bear (also tracked as TA488, Void Blizzard, UAC-0190) has shifted its ongoing email espionage campaign from Zimbra to Microsoft Outlook Web Access, deploying a new JavaScript implant called OWAReaper that survives credential resets and device re-imaging. The campaign exploits CVE-2026-42897 (CVSS 8.1), a cross-site scripting vulnerability in on-premises Exchange OWA, using a "half-click" technique that triggers the exploit simply when a user views the email in their browser. No clicks, attachments, or links are required.

What Changed

Laundry Bear previously exploited CVE-2025-66376 in Zimbra Collaboration Suite (ZCS), deploying a JavaScript implant dubbed ZimReaper. The shift to OWA represents a significant expansion of target scope and an evolution in tradecraft. The new OWAReaper implant is more stealthy and more persistent than its Zimbra predecessor.

The campaign was first documented in a joint advisory from NCSC, CISA, NSA, FBI, and Five Eyes partners on July 23, 2026 (AA26-204A), initially covering the Zimbra vector. Since then, researchers at Proofpoint and Blackswan Cybersecurity have confirmed the OWA variant is active, with infrastructure preparation dating back to March 2026 and active exploitation from July 22 onward.

How OWAReaper Works

The initial access vector is deceptively simple: vague, legitimate-looking emails about supply chain updates, research notes, or market metrics, sent from compromised or adversary-controlled accounts (including Proton Mail). JavaScript payloads are concealed inside social media icon images in the message HTML, assembled from Base64 fragments at runtime.

Once loaded in the OWA reading pane, OWAReaper:

- Removes the exploit email from the server, destroying evidence of the initial vector - Writes an encrypted implant and decryption wrapper to browser localStorage, auto-executing whenever OWA is opened - Injects a hidden iframe into the offline IndexedDB message cache, re-infecting the browser even after a full device re-image - Grants itself Owner-level permissions on mail folders via Outlook add-ins with ReadWriteMailbox scope - Steals OAuth tokens and credentials via browser autofill capture - Exfiltrates at least 90 days of email content over AES-CTR encrypted HTTPS, with DNS tunneling as a fallback C2 channel - Receives commands via GitHub commit search API polling or inbound email

Why This Is Different

Credential rotation does not remove the actor. Device re-imaging does not remove the actor. The persistence lives on the Exchange server (via hidden iframe in offline cache) and in the browser environment (via localStorage). Organizations that respond to suspected compromise by resetting passwords and wiping endpoints will remain compromised.

The targeting scope is broad: US and European government entities, telecommunications, financial services, hospitality, and aerospace. Any organisation running on-premises Exchange with OWA exposed is potentially vulnerable.

Who Is Affected

On-premises Microsoft Exchange Server deployments with OWA accessible to users. Exchange Online (Microsoft 365) is not affected by this specific vulnerability. Organisations in government, telecoms, finance, aerospace, and energy sectors in Europe and North America are the primary targets.

So What / Action

Patch CVE-2026-42897 immediately on all on-premises Exchange servers. If you run Exchange OWA and have not applied this patch, treat it as an active compromise assumption.

Hunt for indicators: unusual OWA localStorage entries, hidden iframes or anomalous IndexedDB activity related to OWA, unexpected Owner permissions on mail folders, suspicious GitHub API queries from Exchange servers, and DNS tunneling patterns matching known OWAReaper signatures.

Audit and restrict Outlook add-ins with ReadWriteMailbox permissions. These are the primary mechanism for privilege escalation and OAuth token theft.

Review email logs for the half-click phishing pattern: generic informational emails with no links or attachments, particularly from Proton Mail addresses or recently compromised accounts. The email itself is the weapon.

Assume breach for any organisation that has run unpatched OWA since July 2026. OWAReaper's persistence mechanisms mean that standard remediation (password reset, device wipe) is insufficient. Full Exchange server investigation and OWA cache clearing is required.

Sources: Blackswan Cybersecurity, Proofpoint, NCSC/CISA/NSA/FBI Joint Advisory AA26-204A, Check Point Research