Outlook OWA and Russia Linked Cyber Attacks and Mitigations

 

Russia-linked threat group called Laundry Bear (also tracked as Void Blizzard/TA488) exploiting a zero-day vulnerability in Microsoft Exchange Outlook Web Access (OWA) to maintain long-term access to email accounts. 

Key points reported

• The vulnerability is identified as CVE-2026-42897, described as an XSS (cross-site scripting) flaw in Exchange OWA.
• The attack reportedly requires a victim to open or view a malicious email in OWA, without clicking links or attachments. Researchers have referred to this as a "half-click" exploit.
• The malware, called OWAReaper, is said to run inside the OWA reading pane and remove traces of the exploit from the email after execution.
• Reported persistence mechanisms include:
  • Granting Owner-level mailbox permissions to a low-privilege account.
  • Injecting malicious content into cached emails using browser-side storage mechanisms. 
• The campaign has been linked by Proofpoint to the same group associated with earlier Zimbra-targeting attacks. 

Why it matters

If the reporting is accurate, the persistence techniques mean attackers may retain access to a mailbox even after actions such as password changes, making detection and remediation more challenging.

Recommended actions for Exchange administrators

• Apply Microsoft security updates as soon as vendor guidance becomes available.
• Review mailbox delegations and permissions for unexpected owner or full-access grants.
• Monitor OWA activity for unusual authentication or mailbox-access patterns.
• Audit privileged and service accounts connected to Exchange.
• Enable and review mailbox auditing logs.

  IOCs and Mitigation Guidance

  Based on reporting about the alleged Exchange OWA campaign using OWAReaper, defenders should focus on identifying unauthorized mailbox access and persistence. The source specifically mentions mailbox permission abuse, malicious email delivery, and unusual command-and-control behavior. 

  Potential Indicators of Compromise (IOCs)

  Mailbox Permissions

  Look for unexpected mailbox delegation changes, especially:
  • New Owner permissions assigned to low-privilege accounts.
  • Unexpected Full Access or delegation assignments.
  • Permission changes that do not align with administrative activity. 

  OWA Activity

  Investigate:
  • Users who viewed suspicious emails shortly before abnormal mailbox activity.
  • Unusual OWA sessions originating from unfamiliar IPs or geographies.
  • Access to mailboxes after password resets or account remediation. 

  Command and Control Activity

  The report states the malware may use:
  • GitHub commit messages as a command channel.
  • Emails delivered to the mailbox as a command channel.
  • HTTPS communications routed through CDN infrastructure.
  • DNS-based fallback communications. 
  Monitor for unexpected outbound connections from systems used for OWA access and unusual DNS activity. (This monitoring recommendation is defensive guidance, not from the source.)

  ---

  Mitigation Steps

  Immediate Response

  1. Apply all available Exchange and OWA security updates.
  2. Audit mailbox permissions tenant-wide.
  3. Remove unauthorized mailbox owners or delegates.
  4. Reset credentials for affected users.
  5. Revoke active sessions and refresh authentication tokens.
  6. Review privileged and service accounts for misuse.

  Detection and Hunting

  • Enable and review mailbox auditing logs.
  • Monitor mailbox permission modifications.
  • Investigate mailboxes generating unusual access patterns.
  • Review security logs for anomalous OWA authentication events. 

  Hardening

  • Require multifactor authentication for all users.
  • Restrict administrative access.
  • Limit internet exposure of OWA where feasible.
  • Implement conditional access policies.
  • Maintain continuous monitoring of mailbox delegation changes.

  Related Intelligence

  This activity was reportedly attributed to the Russian-linked Laundry Bear / Void Blizzard / TA488 group and is described as an evolution of techniques previously observed against Zimbra environments. 
  For official guidance on the related Laundry Bear email-access campaigns, see CISA's advisory: CISA Advisory AA26-204A. 
  If you manage Exchange Server or Exchange Online, I can also provide specific Microsoft Sentinel KQL hunting queries to detect these behaviors.