Russian Hackers Exploit Exchange OWA Zero-Day (CVE-2026-42897)
In May 2026, the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, exploited a zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange's Outlook Web Access (OWA). This cross-site scripting (XSS) flaw allowed attackers to execute arbitrary JavaScript in users' browsers by sending specially crafted emails. Upon opening these emails in OWA, the embedded malicious code executed, leading to the deployment of a sophisticated backdoor named OWAReaper. This malware enabled long-term access to victims' mailboxes, even after system restorations or credential changes. The campaign targeted various organizations, including government entities in the U.S. and Europe, as well as companies in the telecommunications, financial, hospitality, and aerospace sectors. The incident underscores the evolving tactics of state-sponsored threat actors and the critical need for organizations to promptly apply security patches and enhance email security measures. The exploitation of webmail platforms through XSS vulnerabilities highlights the importance of comprehensive security strategies to protect against sophisticated cyber espionage campaigns.
Kill Chain
