Russian APT Group 'Laundry Bear' Exploits Microsoft Exchange OWA Flaw CVE-2026-42897
Executive Summary
Cybersecurity threat researchers at Proofpoint have uncovered an active cyber-espionage campaign orchestrated by the Russia-affiliated threat actor Laundry Bear (also tracked as Void Blizzard, TA488, and CL-STA-1114). The campaign targets high-value U.S. and European government bodies, defense contractors, telecommunications operators, and financial institutions by exploiting CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA).
The attack requires minimal user interaction: simply opening or skimming an incoming email inside the OWA webmail interface triggers hidden HTML payloads, allowing the threat actors to hijack active user sessions, exfiltrate sensitive inbox contents, and establish long-term mailbox persistence.
Deep-Dive Technical Analysis
CVE-2026-42897 represents an input validation and sanitization flaw within Microsoft Exchange OWA's message rendering engine. Threat actors craft email messages containing obfuscated JavaScript loaders split across separate HTML payload blobs inside the email body.
Infection Chain Mechanics
* Lure & Delivery: The targeted user receives an email with banal, non-suspicious subject lines and body text designed to bypass email security filters and prevent the victim from marking the message as spam. No suspicious links or attachments are present.
* Execution on Open: When the victim opens or previews the email in OWA, the browser renders the email body HTML.
* Payload Assembly: A pre-assembled inline script reconstructs an active JavaScript loader from hidden data attributes within the HTML body.
* Session & Cookie Theft: The payload executes within the security context of the user's active OWA session, harvesting session tokens and authentication cookies, and sending them to remote attacker-controlled command-and-control (C2) servers.
* Mailbox Rule Persistence: Using stolen session tokens, the script interacts with OWA REST APIs to silently create malicious inbox forwarding rules or webhooks, ensuring ongoing access to future emails even if passwords are changed.
Industry Impact & Recommendations
Industry Impact
Laundry Bear has previously been linked to zero-day exploitation of Zimbra Classic UI (CVE-2025-66376). This shift to Microsoft Exchange OWA demonstrates the group's relentless focus on webmail perimeter vulnerabilities to conduct diplomatic and strategic intelligence gathering across NATO member states.
Remediation Guidelines
1. Apply Security Updates: Immediately install the latest cumulative updates (CU) and security updates (SU) for Microsoft Exchange Server.
2. Audit OWA Mailbox Rules: Inspect Exchange Server environment logs for newly created mailbox forwarding or redirect rules that route messages to external or unrecognized domains.
3. Revoke Active OWA Sessions: If compromise is suspected, invalidate all active user tokens and reset Exchange user credentials across affected domains.
4. Deploy Content Security Policy (CSP): Enforce strict Content Security Policy headers on Exchange OWA servers to prevent inline script execution and unauthorized cross-domain data transmission.