Laundry Bear (TA488/Void Blizzard) Deploys OWAReaper Backdoor via CVE-2026-42897 Half-Click XSS in Exchange OWA — Persists Through Credential Rotation

Proofpoint disclosed that Russian FSB-linked group Laundry Bear (TA488/Void Blizzard) pivoted to CVE-2026-42897 — an XSS flaw in on-premises Microsoft Exchange's Outlook Web Access — on July 22, approximately 24 hours before joint NSA/Proofpoint exposure of the group's earlier Zimbra campaign. The group's new JavaScript backdoor, OWAReaper, executes inside the victim's authenticated OWA browser session upon email open with no link-click required, then rewrites the source email on the Exchange server to erase exploit artifacts and survives full password resets and device re-imaging. Infrastructure analysis indicates the group may have used the flaw as a zero-day since at least March 2026, targeting U.S. and European government entities, telecoms, finance, and aerospace via lures themed around supply-chain analyses and energy market data.

Infrastructure analysis indicates the group may have used the flaw as a zero-day since at least March 2026, targeting U.S.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.