A Familiar Threat Actor Breaks Its Silence
After roughly five months of quiet, a Russia-aligned espionage group is back in action. Proofpoint researchers spotted TA488 — also known as Void Blizzard and Laundry Bear — launching a fresh campaign on July 22. That’s one day before the company published a joint advisory with the NSA about the group’s earlier Zimbra activity.
The timing wasn’t accidental. Neither was the target list.
Victims spanned US and European government agencies, plus the telecommunications, financial, hospitality, and aerospace sectors. The volume of messages was unusually high for this group. Proofpoint suspects TA488 deliberately flooded inboxes to blend in with routine spam traffic.
No Click Required: The Half-Click Exploit
The campaign weaponized CVE-2026-42897, a cross-site scripting vulnerability in on-premises Exchange Server. Notably, Exchange Online was not affected.
Here’s the unsettling part: merely opening the email in a vulnerable Outlook Web Access (OWA) client triggered the exploit. The victim’s browser executed embedded JavaScript within their authenticated session. No link clicks. No attachments. No user interaction beyond reading the message.
The lures were deliberately boring. Subject lines referenced semiconductor supply chains, gas markets, and tourism statistics. Proofpoint believes this banality was intentional — recipients would open the email, skim it, decide it was junk, and move on without reporting it. That left no suspicious links or attachments for security teams to investigate.
Why It’s Called a Half-Click
Security researchers use “half-click” to describe attacks that require the victim to open or view content but not actively click anything. In this case, the OWA reading pane did all the work. The exploit fired the moment the email rendered.
OWAReaper: An Implant Built to Endure
The payload is something Proofpoint calls OWAReaper — a previously unknown JavaScript implant that the firm describes as the most sophisticated half-click backdoor it has ever observed. It evolved from ZimReaper, the tool used in TA488’s earlier Zimbra campaigns, but dropped that tool’s mass email exfiltration capability.
OWAReaper runs entirely within the OWA reading pane. There’s no conventional file on disk to detect. Instead, the implant:
- Rewrites the original email on the server to strip out the exploit
- Harvests saved credentials from the browser
- Hides an encrypted copy of itself in browser localStorage under a legitimate OWA settings key
- Re-executes itself every time the victim opens a new tab
That alone would be bad enough. But the implant’s most durable mechanism lives server-side.
Server-Side Persistence That Outlives the Device
Where mailboxes had add-ins with write permissions, OWAReaper stole OAuth tokens and granted Exchange’s low-privilege Default user Owner-level permissions on every mail folder. The practical effect: any authenticated account in the organization could read those mailboxes.
The implant also planted a hidden iframe in messages stored in OWA’s offline IndexedDB cache. That iframe re-infects the target even after the host machine has been completely re-imaged.
Because the folder-permission grant lives on the server and requires deliberate removal from Exchange, neither credential rotation nor device re-imaging evicts the attacker. The access simply persists.
Two Command Channels, Two Exfiltration Routes
OWAReaper communicates through a pair of command channels. It queries GitHub commit messages daily, and it polls inbound emails every five minutes. That redundancy means the operators have a fallback if one channel gets disrupted.
Data exfiltration happens over HTTPS, proxied through legitimate image content delivery networks. When that fails, the implant falls back to DNS tunneling — a technique that hides data in DNS queries and is notoriously difficult to block.
Timeline Points to Zero-Day Use
The campaign’s infrastructure dates back to March 2026, roughly two months before Microsoft disclosed the flaw. That timeline makes zero-day exploitation feasible, though registration dates alone don’t confirm exactly when the attackers began using the vulnerability.
Microsoft has since released Exchange security updates addressing CVE-2026-42897. Patching is the first line of defense, but Proofpoint warns it’s not enough on its own.
Defenders Need More Than a Patch
Proofpoint urged organizations running on-premises Exchange to go beyond patching. The firm recommends a four-step cleanup:
- Revoke Exchange Web Services tokens that may have been compromised
- Strip Default-user folder grants from all mailboxes
- Clear OWA’s offline IndexedDB database
- Delete the malicious localStorage key from affected browsers
Skipping any of these steps could leave the door open. The server-side permission grant, in particular, won’t disappear just because you’ve applied the security update.
This campaign is a reminder that Exchange Server security requires ongoing vigilance, not just quarterly patching cycles. For organizations still running on-premises OWA, the threat landscape just got more complicated.
TA488 has demonstrated it can adapt its tools and return after long silences. The question now is which vulnerability it will target next — and whether defenders will be ready.
