Key Takeaways
- The Russian‑linked threat group Laundry Bear (TA488/CL‑STA‑1114) has shifted from exploiting a zero‑day in Zimbra’s Classic UI to weaponizing a cross‑site scripting flaw in Microsoft Outlook Web Access (OWA), CVE‑2026‑42897.
- The attack chain relies on “half‑click” exploits: merely opening a specially crafted email triggers the compromise, eliminating the need for URLs or attachments.
- Initial infections deploy the JavaScript implant ZimReaper, which harvests up to 90 days of mail; subsequent OWA‑focused attacks deliver a more sophisticated implant dubbed OWAReaper.
- OWAReaper establishes persistence on the Exchange server by rewriting emails, storing encrypted code in browser localStorage, and injecting hidden iframes into the offline IndexedDB cache, allowing survival after credential rotation, device re‑imaging, or browser restarts.
- Command‑and‑control is dual‑channeled: the implant queries GitHub’s Commit Search API for encrypted instructions and can also parse attacker‑sent emails stored in the victim’s mailbox.
- Data exfiltration occurs over HTTPS with AES‑CTR‑encrypted URI paths, falling back to DNS label tunneling when necessary.
- The campaign’s infrastructure was created in March 2026—two months before Microsoft disclosed CVE‑2026‑42897—suggesting possible zero‑day use.
- Targeting is broad, spanning U.S. and European government entities, telecommunications, finance, hospitality, and aerospace, while lure content remains generic to blend with mass‑mailing spam.
- The group’s tradecraft has evolved, showing improved loading mechanisms, malware sophistication, and a focus on long‑term, stealthy persistence rather than noisy, one‑off intrusions.
Overview of TA488/Laundry Bear Activity and Timeline
Proofpoint attributes the recent intrusions to the Russian‑linked threat actor Laundry Bear, also tracked as CL‑STA‑1114, TA488, UNK_PitStop, and Void Blizzard. The group first gained notoriety for exploiting a zero‑day cross‑site scripting (XSS) vulnerability in Zimbra’s Classic UI (CVE‑2025‑66376) beginning in July 2025, deploying a JavaScript payload named ZimReaper. After a four‑month patch cycle, the actors pivoted to a new OWA XSS flaw (CVE‑2026‑42897) discovered in May 2026 and actively exploited starting July 22, 2026. This shift marks a deliberate expansion of their toolkit while retaining the signature “half‑click” infection model.
Exploitation of the Zimbra Zero‑Day and ZimReaper
In the earlier Zimbra campaign, TA488 sent emails from attacker‑controlled Proton Mail accounts or previously compromised addresses. Opening the message in a vulnerable Zimbra UI automatically triggered CVE‑2025‑66376, executing a loader that assembled a Base64 fragment from social‑media‑icon elements in the email HTML and ran it as JavaScript. The resulting ZimReaper implant harvested up to 90 days of the victim’s mailbox and other sensitive data, establishing a foothold for further espionage. The group’s use of generic, lure‑free emails increased the likelihood that recipients would view the message without suspicion.
Transition to the OWA Vulnerability (CVE‑2026‑42897)
Microsoft identified CVE‑2026‑42897 as an XSS vulnerability in Outlook Web Access with a CVSS score of 8.1, noting it had been exploited in the wild since May 2026. TA488 began weaponizing this flaw two months later, on July 22, 2026, leveraging the same half‑click approach: the mere act of opening a crafted email in OWA triggered the exploit. The vulnerability resides in the way OWA processes certain HTML elements, allowing attackers to inject script that executes in the reading pane without user interaction beyond opening the message.
Delivery Mechanism: Half‑Click Phishing via Compromised Accounts
The phishing emails contain no clickable links or attachments; instead, they embed malicious script within innocuous‑looking content such as supply‑chain analyses, research updates, or tourism‑market metrics. By using compromised legitimate accounts and Proton Mail addresses, the attackers increase the perceived legitimacy of the messages. When a recipient opens the email, the exploit fires automatically, bypassing traditional security training that advises against clicking links or opening attachments. This technique helps the campaign blend with high‑volume spam, reducing detection odds.
Technical Execution of OWAReaper’s Initial Loader
Upon successful exploitation, a loader script uses the onload= event handler to parse the remainder of the message body, extract a Base64‑encoded fragment, and execute it as JavaScript. The initial trigger and payload blobs are hidden in the HTML’s social‑media‑icon images; the next‑stage data follows # symbols, which the browser stops at when interpreting image sources. This staged delivery obscures the malicious code within seemingly benign image data, evading simple content‑scanning defenses.
Persistence Mechanisms: Server‑Side Rewrite, localStorage, and Hidden Iframes
OWAReaper’s sophistication lies in its multi‑layered persistence. First, it leverages Outlook APIs to rewrite the malicious email on the Exchange server, stripping the exploit content while preserving the implanted code. Second, it writes an encrypted copy of itself and a decryption wrapper to the browser’s localStorage, ensuring automatic execution each time an OWA tab is opened. Third, the implant creates a hidden iframe inside messages stored in OWA’s offline IndexedDB cache; when the victim later opens a cached email, the iframe reinfects the host. These tactics enable the malware to survive credential rotation, full device re‑imaging, and browser restarts, as the persistence resides partially on the server and partially in client‑side storage.
Command‑and‑Control: GitHub Commit Search API and Email‑Based C2
OWAReaper communicates with its operators through two independent channels. Every 24 hours, it queries GitHub’s Commit Search API for commit messages containing the target’s email address; if a match is found, the returned data is decrypted using a hard‑coded key and a per‑session AES key. The decrypted payload begins with a four‑character header indicating the command type: code (replace the implant’s toolkit), domn (rotate C2 servers), or cmnd (execute arbitrary JavaScript via eval). As a fallback, the implant scans the victim’s IndexedDB for inbound emails from TA488 operators that follow the {target_email_address}{space}{Base64text} format, parsing and executing the same command set. This dual‑path design provides resilience against takedowns of any single C2 infrastructure.
Data Exfiltration: HTTPS AES‑CTR and DNS Tunneling
Exfiltrated information—such as harvested mail, OAuth tokens, and internal configuration—is first sent over HTTPS with URI paths encrypted using AES‑CTR. If the HTTPS channel is blocked or monitored, OWAReaper reverts to DNS label tunneling, embedding stolen data within sub‑domains of an actor‑controlled domain and transmitting it via ordinary DNS queries. This stealthy exfiltration method blends with legitimate DNS traffic, making detection by network‑based anomaly systems considerably harder.
Impact, Resilience, and Strategic Implications
Because OWAReaper maintains persistence on the Exchange server, simply rotating user passwords or re‑imaging endpoints does not eradicate the threat; the implant must be manually removed from the mailbox store. Its ability to steal OAuth tokens and grant Owner‑level permissions to the Default user on every mail folder effectively gives the attackers unfettered access to all mailboxes within the compromised organization. The campaign’s broad targeting—government, defense, telecom, finance, hospitality, and aerospace—combined with generic lures indicates a strategy of wide‑scale espionage designed to remain low‑profile while collecting intelligence across multiple sectors. Proofpoint notes that the group’s tradecraft has matured, exhibiting improved loading mechanisms, more robust malware, and a clear focus on long‑term, stealthy access rather than noisy, one‑off intrusions. This evolution underscores the need for organizations to monitor for anomalous server‑side email rewrites, unusual localStorage usage, and atypical DNS queries, in addition to traditional phishing defenses.