Russian-Alligned TA488 Returns With Persistent Outlook Web Access Attack

A Russia-aligned espionage group has resurfaced after months without observed activity, using a half-click exploit against on-premises Outlook Web Access (OWA) to plant a browser-resident implant and establish server-side persistence that can survive credential rotation and device re-imaging.

According to new research from Proofpoint published on July 29, TA488, also tracked as Void Blizzard and Laundry Bear, began the campaign on July 22, one day before the company's joint advisory with the NSA and partner agencies on the group's earlier Zimbra activity. It had not been seen since February.

Targets spanned US and European government entities plus the telecommunications, financial, hospitality and aerospace sectors. The volume was unusual for the group, which Proofpoint suggested may have been deliberate to blend into mass-mailing spam.

Read more on TA488 activity: Russian Hackers Exploit New 'Zero-Click' Attack Against Western Organizations

Banal Lures, No Clicks Required

The messages exploited CVE-2026-42897, a cross-site scripting flaw affecting on-premises Exchange Server, not Exchange Online.

Opening the email in a vulnerable OWA client caused the victim's browser to execute the embedded JavaScript within their authenticated session.

Lures were deliberately unremarkable, with subject lines covering semiconductor supply chains, gas markets and tourism metrics.

Proofpoint said the banality was likely deliberate, so the recipient opened and skimmed the message, then dismissed it as junk without reporting it, leaving no suspicious links or attachments to flag.

Persistence That Outlives the Device

The payload was OWAReaper, a previously unknown JavaScript implant Proofpoint called the most sophisticated half-click backdoor it has seen. It built on ZimReaper from the group's Zimbra campaigns, dropping that tool's mass email exfiltration.

OWAReaper ran entirely in the OWA reading pane with no conventional file on disk. It rewrote the original email on the server to strip the exploit, harvested saved credentials, then hid an encrypted copy of itself in browser localStorage under a legitimate OWA settings key, so every new tab re-executed it.

Its most durable mechanism was server-side: where add-ins with mailbox write permissions existed, it stole OAuth tokens and granted Exchange's low-privilege Default user Owner-level permissions on every mail folder, opening the mailbox to any authenticated account in the organization.

It also planted a hidden iframe in messages held in OWA's offline IndexedDB cache, which re-infected the target even after the host was re-imaged. Because the folder-permission grant lived server-side and required deliberate removal from Exchange, credential rotation and re-imaging did not evict the actor.

Two Command Channels, Two Exfiltration Routes

Commands arrived via GitHub commit messages, queried daily, or inbound emails polled every five minutes. Exfiltration occurred over HTTPS, proxied through legitimate image content delivery networks, with a fallback to DNS tunneling.

The campaign's infrastructure dates to March 2026, roughly two months before Microsoft disclosed the flaw, making zero-day use feasible, though registration dates alone don't confirm when exploitation began. Microsoft has since released Exchange security updates addressing the flaw.

Beyond patching, Proofpoint urged defenders to revoke Exchange Web Services tokens, strip Default-user folder grants and clear OWA's offline database and localStorage key.