A Russia-aligned espionage group has recently resurfaced after months of dormancy, executing a sophisticated campaign that leverages a half-click exploit against on-premises Outlook Web Access (OWA). This technique facilitates the implantation of a browser-resident backdoor and enables server-side persistence that can withstand credential rotations and device re-imaging.
According to research published by Proofpoint on July 29, the espionage group known as TA488, also recognized as Void Blizzard and Laundry Bear, initiated this campaign on July 22, just one day prior to a joint advisory issued by the National Security Agency (NSA) and affiliated agencies regarding the group’s previous activities involving Zimbra. Notably, there had been no reported activity from TA488 since February, making this resurgence particularly notable.
The group’s targets include various entities across the United States and Europe, specifically focusing on government organizations and sectors such as telecommunications, finance, hospitality, and aerospace. The volume of targets identified within this campaign has raised eyebrows; Proofpoint suggested that the high number of targets might have been a strategic move to camouflage their activities within generalized spam emails.
### Banal Lures: No Clicks Required
The emails utilized in this campaign took advantage of CVE-2026-42897, a cross-site scripting flaw that affects on-premises Exchange Server, while being ineffective against Exchange Online. When a victim opens an email using a vulnerable OWA client, the browser is compelled to execute embedded JavaScript within an authenticated session, thereby compromising the user.
The lures employed in the emails were intentionally plain and non-descript, featuring subject lines related to semiconductor supply chains, gas markets, and tourism metrics. This mundane approach appears to have been a tactical decision, leading recipients to open and skim through the messages without fully engaging. Consequently, they might have dismissed the email as junk, leaving no suspicious links or attachments that could raise alarms.
### Persistence That Outlives the Device
At the center of the campaign is a previously unknown JavaScript implant named OWAReaper. Proofpoint described this tool as the most advanced half-click backdoor they have encountered thus far. OWAReaper builds on the foundation of ZimReaper, which was utilized in the group’s prior Zimbra-related activities, eliminating the tool’s mass email exfiltration feature.
Functioning entirely within the OWA reading pane, OWAReaper does not rely on traditional files stored on disk. It cleverly rewrites the original email on the server to eliminate the exploit while simultaneously harvesting saved credentials. Furthermore, it conceals an encrypted version of itself within the browser’s localStorage, under a legitimate OWA settings key. This ensures that the malicious code re-executed every time a new tab opens.
Most critically, the implant establishes server-side persistence. In instances where add-ins with mailbox write permissions exist, OWAReaper steals OAuth tokens, allowing it to assign Exchange’s low-privilege Default user permissions to Owner-level status across all mail folders. This process opens the mailbox to any authenticated account within the organization, effectively creating a backdoor for the attacker. Additionally, a hidden iframe is inserted into messages stored within OWA’s offline IndexedDB cache, allowing re-infection of the target even following a system re-image. Since the folder-permission grant persists server-side, it remains unaffected by measures such as credential rotations or device re-imaging.
### Two Command Channels, Two Exfiltration Routes
The command infrastructure for this operation was ingeniously designed, employing GitHub commit messages for command delivery and polling inbound emails every five minutes. For exfiltration, the group utilized HTTPS, which was deceptively proxied through legitimate content delivery networks, along with a fallback to DNS tunneling methods.
Interestingly, the infrastructure associated with this campaign dates back to March 2026, which is roughly two months before Microsoft disclosed the underlying vulnerability. This timeline makes it likely that the group was exploiting the flaw in its zero-day phase, though the registration dates alone do not provide definitive confirmation of when exploitation actually commenced. In response, Microsoft has since deployed security updates to Exchange that address the exposed vulnerability.
To counter this sophisticated threat, Proofpoint advises defenders to take additional precautionary actions. Measures include revoking Exchange Web Services tokens, eliminating Default-user folder grants, and clearing both OWA’s offline database and localStorage keys to mitigate potential risks associated with OWAReaper.