Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release

Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.

The OWAReaper implant can establish server-side mailbox permissions that remain after credentials are changed and affected devices are rebuilt.

The Invisible Intrusion A completely mundane email, utterly devoid of malicious links or suspicious attachments, proved sufficient for the formidable TA488 hacker collective to secure persistent access to a victim's inbox. Consequently, the perpetrators only needed to wait patiently for the unsuspecting user to open the message within the Outlook web interface. Unveiling the Zero-Click Campaign On July 22, 2026, security analysts at Proofpoint officially uncovered this sophisticated new campaign.

Curate Feeds | Make Collections | Customize Email Briefs

Jim Guckin: security leadership, practitioner writing, and 20+ years of being in the room when things went wrong.

Cet article constitue une analyse technique approfondie de la vulnérabilité CVE-2026-42897 et de la campagne d'exploitation associée menée par le groupe TA488 (également connu sous les noms Void Blizzard et Laundry Bear), acteur étatique russe.

Learn how TA488 uses OWAReaper to exploit Outlook Web Access, steal credentials, and maintain persistent email access across organizations.

TA488 returned with OWA half-click exploit deploying OWAReaper implant that survived re-imaging

Il gruppo criminale filorusso TA488 sfrutta la CVE-2026-42897, falla XSS in Outlook Web Access, con un exploit half-click: basta aprire l'email per installare OWAReaper, una backdoor che sopravvive a reset password e reimaging. Colpiti enti governativi e aziende in USA ed Europa

目に見えない侵入 悪意のあるリンクも不審な添付ファイルも一切含まない、まったくありふれたメール。それだけで、悪名高いハッカー集団TA488は被害者の受信箱への永続的なアクセスを確保するのに十分でした。あとは、疑いを抱かない利用者がOutlookのWebインターフェースでそのメッセージを開くのを、じ

Eine Sicherheitslücke in OWA ermöglicht durch Anzeigen von Mails das Ausführen von JavaScript-Code. Russische Akteure nutzen das aus.

Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential rotation and device re-imaging.

Sicherheitsforscher von Proofpoint haben eine neue Spionagekampagne identifiziert, bei der eine russische Hackergruppe ein hochgradig resistentes Backdoor-Implantat gegen Microsoft Exchange Server einsetzt. Die unter den Bezeichnungen TA488, Void Blizzard oder Laundry Bear bekannte Gruppierung nutzt dabei eine Schwachstelle in Outlook Web Access (OWA), um das als „OWAReaper“ bezeichnete Schadprogramm zu installieren. Dieses zeichnet sich durch […] The post Exchange-Backdoor OWAReaper: Russische Hacker überwinden Disk-Reimaging appeared first on BornCity.

Russian hackers exploit CVE-2026-42897 in OWA to deploy OWAReaper, a browser implant that persists through credential rotation and device re-imaging.

The Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, is exploiting an Exchange Outlook Web Access vulnerability in email campaigns to deliver a sophisticated backdoor called OWAReaper.