Skip to content

TA488 OWAReaper and CVE-2026-42897 exploitation

Summary

Proofpoint reported on July 29, 2026 that TA488, an overlapping public label for the Russian state-supported actor also tracked as LAUNDRY BEAR, Void Blizzard, and CL-STA-1114, began a broad campaign on July 22 exploiting CVE-2026-42897 in on-premises Microsoft Outlook Web Access (OWA). Opening a crafted message in vulnerable OWA is sufficient to execute JavaScript in the authenticated webmail context.

The payload, OWAReaper, persists in browser and server-side state, steals saved credentials and OAuth tokens where a suitable add-in is present, changes mailbox permissions, accepts commands through GitHub or inbound email, and exfiltrates over HTTPS or DNS. Proofpoint observed U.S. and European government, telecommunications, financial, hospitality, and aerospace targeting. Microsoft had patched the flaw out of band in May 2026; Proofpoint says infrastructure predated disclosure and assesses zero-day use as feasible, not confirmed.

Tags

Reported chain

  1. TA488 sends intentionally bland informational messages from compromised accounts. Reported themes include semiconductor supply chains, gas markets, tourism, hydrology, nuclear energy, fisheries, and public-health metrics; there is no attachment or call to action.
  2. When a message is opened in vulnerable OWA, inadequate HTML sanitization allows an onload handler to reassemble Base64-encoded JavaScript hidden in social-media image data and fragments after # characters.
  3. OWAReaper executes inside the reading pane, rewrites the server-side message to remove exploit content, suppresses pop-ups and right-click behavior, and collects the user's email address, username, and OWA settings.
  4. Invisible DOM inputs attempt to collect OWA credentials through browser autofill.
  5. The implant establishes browser, mailbox, and offline-cache persistence, then polls for commands and sends collected state or command output.

Proofpoint calls this a half-click chain: delivery alone is not execution, but viewing the message in vulnerable OWA is enough. Do not infer compromise from receipt without validating rendering, endpoint, Exchange, and network evidence.

Persistence and authority changes

  • OWAReaper stores an encrypted copy of itself and a wrapper in PageDataPayload.OwaUserDefaultSettings, under OWA's OwaFrontendSyncState restore flow. Normal OWA page synchronization executes it when the user opens a new OWA tab.
  • It poisons messages in the owa_offline_db IndexedDB cache with a hidden iframe and enables offline caching. Opening a poisoned cached message can reinfect the browser after device re-imaging if the cache or synchronized state remains.
  • If an installed Outlook add-in has ReadWriteMailbox, OWAReaper calls GetClientAccessToken to steal an Exchange Web Services token.
  • It calls UpdateFolder to grant Owner permission to the built-in Default principal on every mail folder. This can expose the mailbox to any authenticated user in the organization and persists on Exchange until deliberately removed.

Password rotation and endpoint re-imaging are therefore insufficient containment actions by themselves.

Command, control, and exfiltration

  • Every 24 hours, the implant searches public GitHub commit messages for the target email address and decrypts matching task data with a hard-coded key plus a per-session AES key.
  • code replaces the implant, domn rotates C2, and cmnd executes arbitrary JavaScript through eval().
  • A second channel polls OWA's offline message cache every five minutes for recent inbound emails matching {target_email_address} {Base64text}.
  • Primary exfiltration uses AES-CTR-encrypted URI paths shaped like /assets/v1_<data>, sometimes relayed through images.weserv.nl, i3.wp.com, or slack-imgs.com to actor infrastructure.
  • Fallback exfiltration encrypts and Base32-encodes data into DNS A-query labels.
  • File bodies sent directly by HTTP POST are not encrypted by the implant. Reported names include ews_extensions_debug.json, msanalytics.json, cmnd_[HASH]_[FILENAME], and poison_wizard_error_dom.html.

Public indicators

Infrastructure

  • asecdns[.]com
  • acocdn[.]com
  • dnsrecursive[.]eu
  • tdndns[.]com

Proofpoint's table labels the first three domains as first seen in 2025 even though its narrative says the earliest campaign infrastructure was created in March 2026. Preserve that source discrepancy and use the domains as historical pivots, not standalone attribution.

Message hash

  • SHA-256: 6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4

Published Emerging Threats SIDs

  • 2071330 — CVE-2026-42897 OWA XSS exploit
  • 2071331 — OWAReaper C2 beacon
  • 2071332–2071334 — named-file exfiltration
  • 2071335 — OWAReaper DNS tunneling

Detection and response

  1. Confirm that all on-premises Exchange servers received Microsoft's May 2026 CVE-2026-42897 update or later cumulative protection. Isolate an unpatched OWA surface until remediation is verified.
  2. Preserve the raw message, Exchange/OWA/EWS audit data, browser profile, localStorage, owa_offline_db, DNS, proxy, and endpoint evidence before clearing state.
  3. Search messages for unusual onload handlers, Base64 image fragments, social-media icon payload containers, and the published message hash. Scope all users who rendered matching mail in OWA.
  4. Audit and revoke EWS/client-access tokens issued through Outlook add-ins. Review add-ins with ReadWriteMailbox and investigate unexpected GetClientAccessToken calls.
  5. Audit every mailbox folder for Owner or other abnormal permissions granted to Default; remove unauthorized grants and identify the account and source that created them.
  6. On affected endpoints, clear the malicious PageDataPayload.OwaUserDefaultSettings state and owa_offline_db only after preservation. Check synchronized or roaming browser state before returning the account to service.
  7. Hunt GitHub commit-search traffic containing user email addresses, five-minute offline-cache polling patterns, /assets/v1_ requests through image CDNs, direct POSTs of the named files, and high-entropy Base32-like DNS labels to reported infrastructure.
  8. Revoke sessions and tokens, reset credentials from a clean device, and scope mailbox contents for secondary credential, contact, and sensitive-data exposure.

Attribution and evidence notes

Proofpoint attributes the activity to TA488 from its webmail half-click technique, OWAReaper's overlap with ZimReaper, encoded DNS exfiltration, and focus on email and credential theft. The July 2026 joint government advisory treats TA488, LAUNDRY BEAR, Void Blizzard, and CL-STA-1114 as overlapping public labels and warns that they may not map one-to-one. Retain source-specific naming.

Sources